15

I vaguely remember hearing that Gravatar had some security or privacy flaw. I think it was that someone could extract your e-mail address if you used a Gravatar. Is Gravatar safe? How do you know?

Update: There's a similar question about it on Meta Stack Overflow, but I don't understand the discussion well enough to know if I should worry about using Gravatar.

Improve this question

2 Answers 2

Reset to default
10

Speaking personally I've used Gravatar since signing up with Stack Overflow nearly 2 years ago and haven't noticed any problems.

I used a unique e-mail address which is only used for Stack Exchange sites which means that if it was compromised they wouldn't get very far, and if e-mails started turning up from strange sources using that address I'd know it had been hacked.

So far I haven't had any such e-mails.

Improve this answer
5
  • Hmm...good idea. Not sure setting up a unique e-mail address would work for me, though.
    – Firefeather
    Dec 3, 2010 at 19:45
  • Not really hacked, per se, but more extracted.
    – digitxp
    Dec 3, 2010 at 20:03
  • 1
    @digitxp - which is why I use a different e-mail for Gravatar to everything else. That way if it is compromised they can't get access to other accounts (Facebook, LinkedIn etc.) because that's not the e-mail I used to sign up to those.
    – ChrisF ♦
    Dec 3, 2010 at 20:15
  • 1
    would it be good enough to use a Gmail plus alias (adding + and whatever word you want, just before the @ sign), then?
    – Firefeather
    Dec 15, 2010 at 17:36
  • 1
    @Firefeather - probably. I don't use Gmail myself, but to the site where you're signing up it will be a different e-mail address - though if it does get harvested it would be easy to get your base address.
    – ChrisF ♦
    Dec 15, 2010 at 17:53
23

No! Don't give your portrait to Gravatar. Regardless of whether you trust Gravatar Corp, site owners can carelessly betray the identity of users posting under pseudonyms. A cautionary tale:

Hashim in Saudi Arabia secretly reads an American blog about homosexuality. One time, the blog discusses the Middle East, so Hashim comments describing his own experience. He is careful to give a false name 'bin Elton' to protect his identity. However the blog software, Wordpress, also demands an email address. The software promises 'your email address will not be published'. Hashim trusts the blog owner and thinks nothing of typing his email address [email protected]. There's no risk, his email doesn't even contain his real name

Two years later, Hashim signs up for Stack Overflow under his real name. He gives Gravatar his email and portrait.

Unbeknownst to Hashim , in 2011 Wordpress decided to install Gravatar on their platform, to make it 'more social'. Portraits are added to new comments, but also to millions of archived comments. (Wordpress didn't consider this a privacy issue, because email addresses remain secret). As a consequence, Hashim's portrait is now publicly displayed next to bin Elton's story.

Improve this answer
0

Not the answer you're looking for? Browse other questions tagged or ask your own question.