Don't use Gravitar
On a website that helps people mitigate the impact of losing private data you prevent use of avatars without signing up to an arbitrary third party with whom users may have no previous relationship and certainly no reason to trust. This feels strangely at odds with the core ethos of your website.
Looks like this is an issue with UserVoice, not HIBP.
-
Eduardo R. commented
There's no need to tell me how to identify people by the gravatar. I just realized how to do it. Very dangerous. Based on what I found with only 2 avatars that I picked randomly in other posts I think this is not the best place to talk in such detail level. Of course not everyone that uses gravatar has a problem as my own avatar didn't revealed anything useful about me.
It's not a HIBP problem and I also think it's not a uservoice.com problem. The problem is having a Gravatar avatar and not being able to choose what sites can use it. Of course we should be able to disable it in uservoice.com but the whole problem could be avoided no matter in what website it happens if gravatar.com let the users enable or disable gravatar for specific websites in a central place.
-
Eduardo R. commented
I think you're talking about uservoice.com
I noticed that it showed my gravatar.com avatar when I created an account with the same email address here. I tried to remove it but there's no such option.
There's no option in gravatar.com to choose what sites can use the avatar. I removed my gravatar account.
However I was unable to find way to link my avatar to may email address or to me in general... I can say the same about yours. Our emails are not shown anywhere. But I'd like to know if you found a way to identify someone by the avatar, this may be a real risk for some people if it's possible.
-
Stuart commented
I can't see anywhere on HIBP that uses Gravitars.
I can only find the Disqus comments section on your blog, which does require a signup to comment. Maybe the OP is referencing that
-
Which feature of HIBP are you referring to? There are no avatars used, nor do people create accounts that they could be used on.