10

Disclaimer: I am hesitant to ask this question. If it doesn't belong, let me know.

So apparently, there's a thing called an identicon and it's what makes up my profile picture. Well, I got curious and stumbled upon multiple SE answers on identicons. There's one particularly interesting one though, so I took a look on Security.SE...

In this comment on Security.SE, @Anders wrote:

On a side note, a couple of years ago a bunch of far-right politicians in Sweden were exposed spreading racist and antisemitic trash on the internet, thanks to their gravitars being bruit forced.

Naturally, I'm unsure of the validity of this statement. I've never heard of the story. Searches for "sweden identicon brute force", "politician identicon brute force", "swedish gravatar brute force", and similar have returned the SE question and answer among the first page, with no relevant results I can identify. Anders' own source doesn't seem to be relevant.

Were far-right Swedish politicians' identicons brute forced "a couple of years ago"?

Have there been any scandals of any (not limited to Sweden's) politicians' identicons been brute forced?

But why not ask this on Security.SE! With a more Security-y twist, it will surely fit there. Good question! It has been closed there.

But why not ask this on Skeptics.SE! With a more Skepticy twist, it will surely fit there. Good question! It has been criticized and almost closed there (and now deleted).

  • I will be offering a bounty of 100 rep to the most helpful answer (if your answer is the only one, no matter how irrelevant, it will get a bounty). Please retag and edit as appropriate! Thanks! – Barry Harrison Apr 30 at 6:27
  • “Anders' own source doesn't seem to be relevant.” – Why not? It doesn’t go into technical details, but the high-level description would certainly fit. – chirlu Apr 30 at 7:05
  • Gruppen har hittat ett sätt, enligt deras egen beskrivning utan någon form av olaga intrång, att knyta de användarnamn som de anonyma kommentatorerna på hatsajterna använder sig av till de mejladresser som kommentarerna skickats från. (…) I nästan samtliga fall har de personer vi konfronterat - som de SD-politiker landet runt som vi berättar om i dag - bekräftat att det verkligen är de som står bakom mejladresserna och som skrivit de hatiska kommentarerna. – chirlu Apr 30 at 7:25
  • No; not based on that article in any case. It would fit, but the identities could have been found out by other means, too. – chirlu Apr 30 at 8:20
  • 4
    @BarryHarrison I suspect based on thelocal.se/20131212/… the original comment is conflating a few different issues. It appears that the underlying "attack" was on the forum platform, which provided an API including hashed email addresses. The API was in turn used by 3rd party services such as Gravater. That meant a known email could be tested against accounts to try to find an individuals comments. I suspect googling could confirm this for a Swedish reader (unfortunately not me). – origimbo Apr 30 at 9:39
4
+100

I would assume that this is the case that you were looking for. I've no idea if the same method has been used again since, nor have I fact checked the latter incident, but I'm familiar enough with how Gravatar works to help you understand how easily it can be abused to track politicians on racist websites that support Gravatar.

For context, Gravatar, which is operated by Automattic, is a service that's built into WordPress. The latter has a huge share of CMS operated websites, and anyone who has ever left a comment on a WordPress blog almost certainly has a Gravatar ID. It's tied to one of the default images if they haven't registered. Because of its ubiquitous nature on blogs, it's common for forum software and commenting systems to offer using Gravatars out of the box or as an add-on. There even are email add-ons. When Gravatars are supported, new users basically get an identicon for free, without configuring a thing. And as a result of this, Gravatar has a huge share of the identicon market.

A decade ago, Gravatar's algorithm to generate a user's ID basically was: md5(email). It apparently hasn't changed since. This means two things:

  1. Once you know someone's email addresses you also know their Gravatar IDs.
  2. Once you know someone's Gravatar IDs (knowing their emails or not), you can use the fact that it doesn't change from a site to the next to track people using their Gravatar IDs. In particular, you can crawl websites where you think they might be leaving comments, and read what they're writing on these sites.

Even when you don't know a politician's email or Gravatar ID, their email addresses aren't too hard to locate or guess. In the unlikely event you can't locate a politician's email, and that cursory social engineering (aka asking their office) doesn't work, you can quickly generate a shortlist of possibilities. More often than not they'll be using gmail (or similar), a party email, or an official (government, parliament, etc.) email. You'll likely get a match or more if you google each option. And in the worst case scenario, it's trivial to md5 each sensible option (john.smith@, jsmith@, etc.) and assume they all work.

The last remaining step from there is to match the resulting Gravatar IDs against a list of Gravatar IDs you've found on any given website, and voilà.

  • Is Gravatar the same as those identicons? It'd help to specify that more explicitly I think. – JJ for Transparency and Monica May 5 at 13:18
  • @JJJ: Gravatar is the utterly dominant provider. – Denis de Bernardy May 5 at 14:20
  • 2
    However it should be noted that Gravatar matching in no way proves that the person in question actually wrote these comments. Anyone can use anyone's email address to write provocative comments on WordPress, so denying any involvement is a valid defense. – JonathanReez Supports Monica May 5 at 17:41
  • 2
    @JonathanReez: if you follow the relevant link and google translate the Swedish source, you'll read: "In almost all cases, the people we confronted - as the SD politicians around the country we tell about today - have confirmed that they really are the ones behind the email addresses and who have written the hateful comments." – Denis de Bernardy May 5 at 18:35
  • 1
    @BarryHarrison: not my work, but here's another example: dontreadthecomments.org/examples – Denis de Bernardy Sep 21 at 19:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .