gravatar and tracking

  • Resolved AliceWonderFull

    (@alicewonderfull)


    11 years ago

    I’ve noticed that with many blogs, even though I had never signed up with gravatar, the MD5 hash of my e-mail was in the image request for an avatar when I post.

    This is a privacy concern because it means bots that crawl the web can track what blogs I post on and keep that info in a database to track me, using the hash of my e-mail as a key.

    I installed wordpress 3.7.1 on my laptop and did some experimenting, it seems that with a default wordpress install, the gravatar image links only include the hash of my e-mail if that e-mail is associated with a gravatar account. Otherwide it just uses a hash of [email protected]

    It seems that wordpress continually checks because when I made a post from an e-mail account without a gravatar, it used the hash from unknown but as soon as I went to gravatar.com and registered it, a browser refresh and all comments by that user now had their hash in the image src URI.

    I wrote a simple plugin that modifies the get_avatar() behavior so that if the e-mail address is not whitelisted or in a whitelisted domain, it obfuscates the e-mail address before hashing it (what I do is take a sha256 hash of a salt plus the e-mail and then a md5 hash of a salt plus the sha256 hash)

    That will prevent tracking of users who reply, and my plugin works, but what happens is that gravatar.com doesn’t recognize the hash, wordpress replaces the obfuscated hash with a hash of [email protected]. That’s fine.

    But what I don’t know is how sites that use monster, retro, etc. gravatars work. I don’t have any clue what themes or plugins I need to install to test my plugin with them.

    Do they use their own get_avatar function or do they run a filter that prevents the existing check from running?

    Does anyone know?

    I would like to produce a plugin that works everywhere so that webmasters who care about their users privacy can neuter this tracking issue while still allowing white list and the specific to user monster/retro/etc themed gravatars.

    [Moderator Note: No bumping. If it’s so urgent that you cannot wait longer than 2 hours on a forum staffed by unpaid volunteers, consider hiring someone.]

Viewing 1 replies (of 1 total)
  • Thread Starter AliceWonderFull

    (@alicewonderfull)

    Well OK, it was my first post and I saw a lot of activity in the forum so I thought perhaps I just posted in the wrong forum.

    It doesn’t matter though, I found the monster/retro in the default WP – the options to select them just were not obvious to me. I haven’t used wordpress in years, and only took up interest just recently when I saw the obvious tracking issue with gravatar.

    My plugin works with those custom generated themes. For those interested –

    function smartAvaHash($email) {
	//note to self - these four should be configurable in a webgui
	$salt   ='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';
	$ssalt  ='bbbbbbbbbbbbbbbbbbbbbbbbb';
	$domains=array('somedomain.com','anotherdomain.com');
	$addys  =array('[email protected]','[email protected]');

	$email=trim(strtolower($email));
	//validate email
	if(!filter_var($email, FILTER_VALIDATE_EMAIL)) { //hopefully wordpress already has validated this but...
	                                                 //  ...it wouldn't be the first time someone didn't.
		$email='[email protected]';
		}
	$foo=explode('@', $email);
	$domino=$foo[1]; //this is domain part of @domain
	$qq=0;
	//check for white-listed domain
	$j=sizeof($domains);
	for ($i=0;$i<$j;$i++) {
		$test=trim(strtolower($domains[$i]));
		$dummy='user@' . $test;
		if(filter_var($dummy, FILTER_VALIDATE_EMAIL)) {
			//check for exact match first
			if(strcasecmp($domino, $test) == 0) {
				$qq++;
				} else {
				$domino='.' . $domino; //for testing if $test is subdomain
				$qq = $qq + substr_count($domino, $test); //any matches and $qq is no longer 0
				}
			}
		}
//check for white-listed address
	if ($qq == 0) {
		$j=sizeof($addys);
		for ($i=0;$i<$j;$i++) {
			$test=trim(strtolower($addys[$i]));
			if(strcasecmp($test, $email) == 0) {
				$qq++; //any match and $qq is no longer 0
				}
			}
		}

	if ($qq == 0) {
		$obf=hash('sha256', $ssalt . $email);
		return(md5($salt . $obf)); //obfuscate
		} else {
		return(md5($email)); //this means there was a white-list match, don't obfuscate
		}
	}

    Then in the I replicate the get_avatar() function as it is in pluggables.php except I call the above function instead of md5()

    Obviously you’ll want to set up the $salt $ssalt $domains and $addys to suit you.

    That not only will prevent non white-listed addresses (what $domains and $addys are for) from having their e-mail hashes exposed to bot, it also will prevent gravatar.com from being able to track users by e-mail hash.

Viewing 1 replies (of 1 total)
  • The topic ‘gravatar and tracking’ is closed to new replies.