Have politicians' identicons been brute forced?

Question

Disclaimer: I am hesitant to ask this question. If it doesn't belong, let me know.

So apparently, there's a thing called an identicon and it's what makes up my profile picture. Well, I got curious and stumbled upon multiple SE answers on identicons. There's one particularly interesting one though, so I took a look on Security.SE...

In this comment on Security.SE, @Anders wrote:

On a side note, a couple of years ago a bunch of far-right politicians in Sweden were exposed spreading racist and antisemitic trash on the internet, thanks to their gravitars being bruit forced.

Naturally, I'm unsure of the validity of this statement. I've never heard of the story. Searches for "sweden identicon brute force", "politician identicon brute force", "swedish gravatar brute force", and similar have returned the SE question and answer among the first page, with no relevant results I can identify. Anders' own source doesn't seem to be relevant.

Were far-right Swedish politicians' identicons brute forced "a couple of years ago"?

Have there been any scandals of any (not limited to Sweden's) politicians' identicons been brute forced?

But why not ask this on Security.SE! With a more Security-y twist, it will surely fit there. Good question! It has been closed there.

But why not ask this on Skeptics.SE! With a more Skepticy twist, it will surely fit there. Good question! It has been criticized and almost closed there (and now deleted).

Answer 1

I would assume that this is the case that you were looking for. I've no idea if the same method has been used again since, nor have I fact checked the latter incident, but I'm familiar enough with how Gravatar works to help you understand how easily it can be abused to track politicians on racist websites that support Gravatar.

For context, Gravatar, which is operated by Automattic, is a service that's built into WordPress. The latter has a huge share of CMS operated websites, and anyone who has ever left a comment on a WordPress blog almost certainly has a Gravatar ID. It's tied to one of the default images if they haven't registered. Because of its ubiquitous nature on blogs, it's common for forum software and commenting systems to offer using Gravatars out of the box or as an add-on. There even are email add-ons. When Gravatars are supported, new users basically get an identicon for free, without configuring a thing. And as a result of this, Gravatar has a huge share of the identicon market.

A decade ago, Gravatar's algorithm to generate a user's ID basically was: md5(email). It apparently hasn't changed since. This means two things:

1. Once you know someone's email addresses you also know their Gravatar IDs.
2. Once you know someone's Gravatar IDs (knowing their emails or not), you can use the fact that it doesn't change from a site to the next to track people using their Gravatar IDs. In particular, you can crawl websites where you think they might be leaving comments, and read what they're writing on these sites.

Even when you don't know a politician's email or Gravatar ID, their email addresses aren't too hard to locate or guess. In the unlikely event you can't locate a politician's email, and that cursory social engineering (aka asking their office) doesn't work, you can quickly generate a shortlist of possibilities. More often than not they'll be using gmail (or similar), a party email, or an official (government, parliament, etc.) email. You'll likely get a match or more if you google each option. And in the worst case scenario, it's trivial to md5 each sensible option (john.smith@, jsmith@, etc.) and assume they all work.

The last remaining step from there is to match the resulting Gravatar IDs against a list of Gravatar IDs you've found on any given website, and voilà.