Take the 2-minute tour ×
Stack Apps is a question and answer site for apps, scripts, and development with the Stack Exchange API. It's 100% free, no registration required.

Given a user's email, it would be great if we could hash it and search for that user with it.

The reason for this is suppose:

  • Someone has a website
  • On that website, they invite SO users to enter their email
  • The site hashes the email and retrieves their profile
share|improve this question
    
george, have you really thought through what you're asking here? This would be a massive privacy violation. –  Jeff Atwood Jun 9 '10 at 8:09
    
@Jeff: No - there would be no additional information made available. Only a new way of searching for existing info. –  Nathan Osman Jun 9 '10 at 12:51
1  
@jeff - while i agree that exposing a method that allows search of user records by email hash would be a BIG blinking target for abuse, there is no more privacy violation than including the email hash in the user data structure in the first place, which is none, really. First: The users email is arbitrary in the first place and unless you are in the CIA, authoritatively associating an email to a person is quite a task. Second, we are talking about a one-way hash with possibility of collision. So - true = FindByEmailHash == Bad != PrivacyViolation; –  Sky Sanders Aug 11 '10 at 22:46
1  
@jeff, and you have to have an email address in hand in order to hash it. but that is neither here nor there. –  Sky Sanders Aug 11 '10 at 22:47
    
geo - good question, one that I have considered, and ++ for eliciting edifying responses. –  Sky Sanders Aug 11 '10 at 22:48

3 Answers 3

While the hash is available as a member of the users object, exposing a method to search by hash would be a blinking target for abuse.

you would have to perform this type of filter on a locally cached set of user records.

since the hash is used to serve the gravatar, it is assumed that SO lcases the email as well before hashing it.

simply do an md5 hash on an lcased email and filter your cached user records.

share|improve this answer
    
Hmmh, haven't thought that through really, but isn't not exposing a method anything but script kiddie protection, i.e. anybody inclined to have that method can build one by himself as per your instructions (and very productive enabling work via SOAPI ;) - or am I missing something here? Does this sort of kinda low first line of defense really help in reducing abuse? Just a short comment/thought, I'm well aware that discussing privacy/security thoroughly would deserve a dedicated Stack Exchange site in principal ... –  Steffen Opel Aug 12 '10 at 13:12
    
@steffen - reducing attack surface goes a long way to reducing attacks/abuse. If there were an actual security or privacy issue then security through obscurity would be a negligent choice. In this case, where the characteristics of the 'abuse' are innocuous, not providing a route that returns a user for a hash seems appropriate. Using soapi, I can pull every user in stackiverse with rep > 100 in less than 5 minutes. It takes about an hour to get EVERY user. Then I don't need a method. But what am I going to do with the info that is dangerous or violating? –  Sky Sanders Aug 12 '10 at 13:38
    
@steffen - what I am going to do with it is improve the UX on my stack exchange related sites, allowing a user to login to my site with open id and i will already have a good start on presenting their data. And I just need one matching hash to get an associationid which gives me all of their other accounts regardless of the hash. –  Sky Sanders Aug 12 '10 at 13:41

No.

E-mail hash is a pretty terrible way to determine account association, as there's no uniqueness guarantee. I touched on why account associations - which is a more general case of what you're asking for - aren't exposed in this answer, but I'll copy it here too.

Currently, we only have two places it could go:

  • api.[stackoverflow|superuser|serverfault|meta.stackoverflow].com
    • not "global," and accordingly shouldn't know about all the other sites in the network
  • api.stackapps.com
    • more "global," than the above, but also a site onto itself; it'd be a weird one-off to also have it serve up a network map account associations

Once there is an appropriate place, the data will be served up from there.


For your specific use case, might I suggest having the user enter their display name & email address? You can filter based on name, and pick the right one out based on email. Heck, it probably be just as good to just go on name, present the gravatars, and then have the user select the correct one.

share|improve this answer
    
Okay. I just wanted to prevent 50 people from claiming to be Jon Skeet. By requiring an email, I could filter out some of the cheaters. –  Nathan Osman Jun 1 '10 at 0:25

IIRC, there was a feature request discussed on the beta site. I think there was a privacy issue and the feature was declined. Or it may have been deferred until the search/write version of the API was put together.

share|improve this answer
1  
But this information, (the email_hash) is freely available on a user's profile. I just want a way to search for it. –  Nathan Osman May 31 '10 at 18:43
    
@George I can't remember the specific logic that led to the decision not to include it...basically, I am adding nothing of value :) –  TheHurt May 31 '10 at 18:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .