4

If site forums use Gravatar, and the users are predominantly posting personal information about mental health issues, is this a security risk? Should the site consider turning off, or allowing opt out from Gravatar?

On one hand, these users are voluntarily participating in these public forums. On the other hand they are not disclosing their identity and likely believe their identity cannot be trivially exposed.

The risks would seem to be, site owner losing trust, and possibly violating health privacy laws in various countries with identity being considered PII.

Of course, all of this is moot if there is no technical vulnerability. The best summary I can find seems to suggest there may still be some cause for concern: https://www.wordfence.com/blog/2016/12/gravatar-advisory-protect-email-address-identity

  • It may or may not violate any law or regulation, but it is still an easy way to gather intelligence and map it back to a given entity. The question I would ask (in other contexts) is, "could an insurer exploit this somehow to determine whether or not to extend insurance coverage to an individual?" With an email address + avatar mapped directly to mental health testimonials or Erowid posts, it's possible (dunno whether they legally can, but that can be changed with enough lobbying). – Ivan Jul 22 '17 at 21:44
6

HIPAA specifically states that the users email address is protected PII. The md5 hash of the user's password is trivial to reverse, and a data breach of these hashes would result in protected email addresses being divulged - and that would result in legal recourse. The blackhat community is quick to crack hashes, and email addresses can be more predictable than a password.

If an attacker can show that your systems violated HIPAA, then legal action will be taken. Gravatar was never intended to preserve user's privacy, and leaking a gravatar ID of a medical patient is a violation of HIPAA.

  • 1
    As of 2018-10-29 the referenced page says "The following types of PII may be transmitted electronically without protection because they are not considered sufficiently sensitive to require protection [...] Work and personal email addresses" (empasis mine). – Mikko Rantalainen Oct 29 '18 at 9:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.