2

Given a user's email, it would be great if we could hash it and search for that user with it.

The reason for this is suppose:

  • Someone has a website
  • On that website, they invite SO users to enter their email
  • The site hashes the email and retrieves their profile
Improve this question
5
  • 1
    george, have you really thought through what you're asking here? This would be a massive privacy violation.
    – Jeff Atwood
    Commented Jun 9, 2010 at 8:09
  • @Jeff: No - there would be no additional information made available. Only a new way of searching for existing info.
    – Nathan Osman
    Commented Jun 9, 2010 at 12:51
  • 1
    @jeff - while i agree that exposing a method that allows search of user records by email hash would be a BIG blinking target for abuse, there is no more privacy violation than including the email hash in the user data structure in the first place, which is none, really. First: The users email is arbitrary in the first place and unless you are in the CIA, authoritatively associating an email to a person is quite a task. Second, we are talking about a one-way hash with possibility of collision. So - true = FindByEmailHash == Bad != PrivacyViolation;
    – Sky Sanders
    Commented Aug 11, 2010 at 22:46
  • 1
    @jeff, and you have to have an email address in hand in order to hash it. but that is neither here nor there.
    – Sky Sanders
    Commented Aug 11, 2010 at 22:47
  • geo - good question, one that I have considered, and ++ for eliciting edifying responses.
    – Sky Sanders
    Commented Aug 11, 2010 at 22:48

3 Answers 3

Reset to default
3

No.

E-mail hash is a pretty terrible way to determine account association, as there's no uniqueness guarantee. I touched on why account associations - which is a more general case of what you're asking for - aren't exposed in this answer, but I'll copy it here too.

Currently, we only have two places it could go:

  • api.[stackoverflow|superuser|serverfault|meta.stackoverflow].com
    • not "global," and accordingly shouldn't know about all the other sites in the network
  • api.stackapps.com
    • more "global," than the above, but also a site onto itself; it'd be a weird one-off to also have it serve up a network map account associations

Once there is an appropriate place, the data will be served up from there.

For your specific use case, might I suggest having the user enter their display name & email address? You can filter based on name, and pick the right one out based on email. Heck, it probably be just as good to just go on name, present the gravatars, and then have the user select the correct one.

Improve this answer
1
  • Okay. I just wanted to prevent 50 people from claiming to be Jon Skeet. By requiring an email, I could filter out some of the cheaters.
    – Nathan Osman
    Commented Jun 1, 2010 at 0:25
1

While the hash is available as a member of the users object, exposing a method to search by hash would be a blinking target for abuse.

you would have to perform this type of filter on a locally cached set of user records.

since the hash is used to serve the gravatar, it is assumed that SO lcases the email as well before hashing it.

simply do an md5 hash on an lcased email and filter your cached user records.

Improve this answer
3
  • Hmmh, haven't thought that through really, but isn't not exposing a method anything but script kiddie protection, i.e. anybody inclined to have that method can build one by himself as per your instructions (and very productive enabling work via SOAPI ;) - or am I missing something here? Does this sort of kinda low first line of defense really help in reducing abuse? Just a short comment/thought, I'm well aware that discussing privacy/security thoroughly would deserve a dedicated Stack Exchange site in principal ...
    – Steffen Opel
    Commented Aug 12, 2010 at 13:12
  • @steffen - reducing attack surface goes a long way to reducing attacks/abuse. If there were an actual security or privacy issue then security through obscurity would be a negligent choice. In this case, where the characteristics of the 'abuse' are innocuous, not providing a route that returns a user for a hash seems appropriate. Using soapi, I can pull every user in stackiverse with rep > 100 in less than 5 minutes. It takes about an hour to get EVERY user. Then I don't need a method. But what am I going to do with the info that is dangerous or violating?
    – Sky Sanders
    Commented Aug 12, 2010 at 13:38
  • @steffen - what I am going to do with it is improve the UX on my stack exchange related sites, allowing a user to login to my site with open id and i will already have a good start on presenting their data. And I just need one matching hash to get an associationid which gives me all of their other accounts regardless of the hash.
    – Sky Sanders
    Commented Aug 12, 2010 at 13:41
0

IIRC, there was a feature request discussed on the beta site. I think there was a privacy issue and the feature was declined. Or it may have been deferred until the search/write version of the API was put together.

Improve this answer
2
  • 1
    But this information, (the email_hash) is freely available on a user's profile. I just want a way to search for it.
    – Nathan Osman
    Commented May 31, 2010 at 18:43
  • @George I can't remember the specific logic that led to the decision not to include it...basically, I am adding nothing of value :)
    – TheHurt
    Commented May 31, 2010 at 18:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .