Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

So, the nice thing is, this is optional. If you want to sign in with Twitter for everything - go ahead! If you want to create a new cloaked email for everything - you still can.

Just like you advertise your website on your GitHub and your HN profile, I want to make it easy to show my photo on sites that I choose to use. What's wrong with that?



this isn't just letting people use their twitter pic everywhere, it's allowing twitter (and whoever else) to query their email server for an image to represent the user.

services shouldn't leak user email addresses or that those users use that service.

users shouldn't have to juggle different email addresses to maintain distinct identities on different services.

with gravitar, the user is opting into losing pseudonymity, seeing as it's pretty trivial to take lists of email addresses you want to hunt down, md5 them, and then check them against places that user gravitar comments to identify comments are made by someone specific )

with this suggestion, every user on every email server that supports it, which would likely include all the common large ones if the author had their way, would fall afoul of constant identity leakage across every service they use.

an adversary need only crawl different services and hash the user avatars, spam email servers with requests for addresses dropped in leaks or otherwise available publicly, and match them up to remove privacy from the internet




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: