# Gravatar datalek en Discourse: moeten onze gebruikers zich zorgen maken?
**URL:** https://meta.discourse.org/t/gravatar-data-leak-and-discourse-should-our-users-be-worried/211295
**Category:** Community Building
**Created:** [6 december 2021 om 22:15 UTC](https://meta.discourse.org/t/gravatar-data-leak-and-discourse-should-our-users-be-worried/211295 "2021-12-06T22:15:44Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Canapin](https://meta.discourse.org/u/Canapin)
#### Post date: [6 december 2021 om 22:15 UTC](https://meta.discourse.org/t/gravatar-data-leak-and-discourse-should-our-users-be-worried/211295/1 "2021-12-06T22:15:45Z")
Several sources state that there was a leak on October 3, 2020, and people are talking about it just now.
> **[Were you affected by the Gravatar Data Breach?](https://monitor.mozilla.org/en/breach-details/Gravatar)**
>
> Use Mozilla Monitor to find out if your personal information was exposed in this breach, and understand what to do next.
>
I don’t know anything about this kind of stuff, as well as the actual data that was leaked (names and emails are mentioned, but people say only public data was leaked).
I wonder what exactly happened with this 2 years data leak, if it affects our users (considering Discourse uses Gravatar) and if they should be informed about that.
I’d appreciate any information 🙂
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [7 december 2021 om 01:20 UTC](https://meta.discourse.org/t/gravatar-data-leak-and-discourse-should-our-users-be-worried/211295/2 "2021-12-07T01:20:04Z")
Discourse uses gravatar just for avatars. The breach might mean that people who had access to the breached data could infer what someone’s discourse email address is.
Discourse doesn’t use gravatar for authentication, so it doesn’t take affect discourse.
---
### Author:  [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [7 december 2021 om 01:24 UTC](https://meta.discourse.org/t/gravatar-data-leak-and-discourse-should-our-users-be-worried/211295/3 "2021-12-07T01:24:00Z")
From [https://haveibeenpwned.com/PwnedWebsites#Gravatar](https://haveibeenpwned.com/PwnedWebsites#Gravatar)
> ### Gravatar
>
> In October 2020, [a security researcher published a technique for scraping large volumes of data from Gravatar, the service for providing globally unique avatars](https://www.bleepingcomputer.com/news/security/online-avatar-service-gravatar-allows-mass-collection-of-user-info/). 167 million names, usernames and MD5 hashes of email addresses used to reference users’ avatars were subsequently scraped and distributed within the hacking community. 114 million of the MD5 hashes were cracked and distributed alongside the source hash, thus disclosing the original email address and accompanying data.
>
> **Breach date:** 3 October 2020
> **Date added to HIBP:** 5 December 2021
> **Compromised accounts:** 113,990,759
> **Compromised data:** Email addresses, Names, Usernames
> [@Canapin](#):
>
> I wonder what exactly happened with this 2 years data leak, if it affects our users (considering Discourse uses Gravatar) and if they should be informed about that.
Looks like it took a year to crack most of the MD5 hashes. And no, it won’t affect your users.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [7 december 2021 om 01:32 UTC](https://meta.discourse.org/t/gravatar-data-leak-and-discourse-should-our-users-be-worried/211295/4 "2021-12-07T01:32:25Z")
Worth noting how exactly we use gravatar.
Sites such as Stack Overflow, hotlink to gravatar:
So… if my gravatar email leaks, people will trivially be able to connect the email I use at Stack Overflow with gravatar.
Gravatar usage at Discourse is very different, we do not hotlink to gravatar, we download a copy of the avatar and self host. We even resize the images ourselves.
