Is en.gravatar.com Safe?

A handy and useful third party website to incorporate when one has a number of different websites that make use of user profiles and images to identify users and correspondents of the particular website. The above implies (&when not incorporating Gravatar) that a user has to upload/maintain contact details and an image on a number of different websites. A tedious task and only the exceptions to the rule actually makes the effort to update their contact details. ***** allows users to update their contact details and images in one place, which can be used to stream user details and images profile pictures to all the websites that a user subscribes to and/or are a member of. Thus, with incorporating ***** into the AltanaESP Network & System, users aren't bogged down with uploading contact details and profile images to many different websites and AltanaESP, on the other hand, has relevant and updated details "where & when" its needed. ADDED BONUS: AltanaESP use Thunderbird as a default email client, which can be configured to display images and contact details of "email address owners" as registered with Gravatar.com. When receiving emails, one can "see" the person behind the communications... quite a nice "personal touch" to have in a faceless machine world.

After giving this one a second look I found that it's privacy policy isn't too bad and thankfully it was well written and clear. My impression is the privacy/security risk is relatively low. If you want to assume a light risk and have avatars for many sites this might be a candidate to allow. If you have high privacy/security needs then the less you allow the better off you are.

One cannot delete their account on Gravatar. Read this thread: https://groups.google.com/forum/#!topic/tosdr/T98obrJsjJA And also this out: ***** Be careful when signing up! You won't be able to get away.

Privacy risk! To extend on Craig's web bug in some very suspicious way (at the moment, I personally do not have a lot of problems with this, but I don't see any advantages either, so allow me to think about some worst case scenario): The third-party avatar sites could keep track of the IP addresses used to visit sites that include those avatars. (When caching is disabled then each page that shows any avatar, not necessarily my avatar, yields a record of my IP address and the page I visited.) For well-known sites, avatar sites could easily recognise profile URLs in the REFERER header, and hence match profiles to hashed email addresses, and (for a limited time) match IP addresses to hashed email addresses. (If a site would show only my avatar on some home page, or would show my avatar with different size or other URL parameters, then this would even be true without actually viewing my own profile.) Easy data mining will reveal static IP addresses. This also makes it easy to couple otherwise non-related hashed email addresses. If I actually subscribe to the avatar site, then it will at least know how to match the hashed email address to the real address. (And it might have some better insight in static IP addresses.) It's very easy to create some Greasemonkey script to alert one if a specific avatar hash is used on any page one is viewing, hence giving homebrew Sherlocks some means to track people across well-known sites. Using wget-like software makes this even easier (or maybe there's some badly-behaving search engine out there that allows for searching on those hashes). Really, one never knows if one day a site owner is forced to give the logs (including things that have been deleted long ago) to some government agency. Given the display name and the avatar hash, one might validate if a guessed email address is correct. (See Gravatars: why publishing your email's hash is not a good idea.) And kind of a side note: even when I want to use an avatar site, it does not really warn me about using a dedicated email address. So, if some site decides to support avatars years after I left my email address on that site, then years later my avatar could show up on a site that I have long forgotten about. *****

This is just plain spooky! Does no one value any modicum of privacy and freedom of choice any more? I'm a member of MANY different sites. I have different avatars at all of them. I will KEEP it that way by NOT using gravitar or any other "service" like it!!!