Gravatar data leak and Discourse: should our users be worried?

From https://haveibeenpwned.com/PwnedWebsites#Gravatar

Gravatar

In October 2020, a security researcher published a technique for scraping large volumes of data from Gravatar, the service for providing globally unique avatars . 167 million names, usernames and MD5 hashes of email addresses used to reference users’ avatars were subsequently scraped and distributed within the hacking community. 114 million of the MD5 hashes were cracked and distributed alongside the source hash, thus disclosing the original email address and accompanying data.

Breach date: 3 October 2020
Date added to HIBP: 5 December 2021
Compromised accounts: 113,990,759
Compromised data: Email addresses, Names, Usernames

Looks like it took a year to crack most of the MD5 hashes. And no, it won’t affect your users.

6 Likes