> - No this isn't like WebFinger. That only returns JSON.<p>Couldn't it be done with WebFinger though?<p><pre><code> {
"links" : [
{
"rel" : "http://webfinger.shkspr.mobi/rel/avatar",
"href" : "https://cdn.ojford.com/images/avatar.png"
}
],
// ...
}</code></pre>
This seems like a boon to credential stuffing attacks. Given a list of passwords and email addresses, having a well known, email keyed URL would allow an attacker to quickly find if any of the emails have an account on the service, before going through the better secured and more time consuming login page.
I'm not sure why this would need to be its own well-known url instead of just a WebFinger resource, considering it's nearly identical to WebFinger already. Would just have to always return a link to an image instead the image itself (or a base64 blob of image data in a property, I guess) regardless of image/* being in the Accept header.
I might just be getting curmudgeonly in middle age, but I don't like this. I want it to be <i>harder</i> for services to share information about me. My address and phone number are also "public" but that doesn't mean I want every site to keep a copy of them.
> When I sign up to a web service, I don't want to faff around uploading an image to use as my avatar. I want that service to look at my email address or social-sign-in and automatically pick up my preferred graphic.<p>"Faff around" meaning, like, probably four or so clicks?
One idea to consider. Make it easier to implement by changing the query syntax.<p>Instead of a query parameter, which always requires a script to process:<p>example.com/.well-known/avatar?resource=acct:username@example.com<p>Make the requested email address part of the path:<p>example.com/.well-known/avatar/username@example.com<p>People can put images into their HTTP server directory named as email addresses. This makes it easier to implement for vanity domains. No server-side code necessary. It still allows someone to build a dynamic script that handles the "/.well-known/avatar/" path.
Go register it with IANA <i>Well-Known URIs</i>. I don't think IANA demands you have it all figured out to do so! Good idea! <a href="https://www.iana.org/assignments/well-known-uris/well-known-uris.xhtml" rel="nofollow">https://www.iana.org/assignments/well-known-uris/well-known-...</a>
It just occurred to me that Gravatar data is owned by the same folks who decided on selling Tumblr data for AI training: <a href="https://www.theverge.com/2024/2/27/24084884/tumblr-midjourney-openai-training-data-deal-report" rel="nofollow">https://www.theverge.com/2024/2/27/24084884/tumblr-midjourne...</a> …<p>While I don't know enough about the nuances to weigh in on this specific proposal, decentralized solutions are going to become increasingly important!
>This makes it incredibly simple for people to use the same avatar everywhere.<p>lol. who needs privacy or the ability to have disconnected identities online? right?<p>terrible idea.