10

As shown in this question, default user avatars (like mine) are identicons and are generated with the user's email (where provided) or the user's IP address (where the email is not provided).

Given any identicon and information of whether it was generated from an email or IP address, can the email or IP address be identified? If yes, post my email in a spoiler (I registered an email with my account). If no, provide reasoning why.

forest
  • 64,616
  • 20
  • 206
  • 257

1 Answers1

10

It used to be possible, as Gravatar identicons are a graphical representation of the MD5 hash of an encoding (trim leading and trailing whitespace and convert letters to lowercase) of your email or IP address. Both of these things are small enough to make brute force feasible. Nowadays, Gravatar includes a secret salt in the hash operation, making it impossible to even attempt to brute force them without knowledge of that secret. The secret is stored somewhere on the Gravatar servers. If someone was able to obtain that secret, they would be able to brute force the email or IP address.

Note that Stack Exchange's Area 51 site still does not use a salt, unlike the rest of the network.

forest
  • 64,616
  • 20
  • 206
  • 257
  • Do you happen to have any citations? I don't doubt the content, but would like to read more into it. Thanks! –  Apr 02 '19 at 03:54
  • @J.Doe I added a link to a Meta post on the issue. The secret salt is used as of 2013. – forest Apr 02 '19 at 04:01
  • On a side note, a couple of years ago a bunch of far-right politicians in Sweden were exposed spreading racist and antisemitic trash on the internet, thanks to their gravitars being bruit forced. – Anders Apr 02 '19 at 14:46
  • @J.Doe I tried but didnt find the relevant articles. There is simply so many scandals of this sort that finding the right one from four years or so ago is tricky. Sorry. I think the swedish newspaper was Expressen, the party involved was SD, and the group of journalist who were behind it called themself Researchgruppen I think. – Anders Apr 03 '19 at 09:59
  • @J.Doe Here is one article on it, without any technical info and in Swedish: https://www.expressen.se/nyheter/expressen-avslojar/namn-pa-anonyma-anvandare-knackta/ – Anders Apr 03 '19 at 10:01