So, the nice thing is, this is optional. If you want to sign in with Twitter for everything - go ahead! If you want to create a new cloaked email for everything - you still can.

Just like you advertise your website on your GitHub and your HN profile, I want to make it easy to show my photo on sites that I choose to use. What's wrong with that?

this isn't just letting people use their twitter pic everywhere, it's allowing twitter (and whoever else) to query their email server for an image to represent the user.

services shouldn't leak user email addresses or that those users use that service.

users shouldn't have to juggle different email addresses to maintain distinct identities on different services.

with gravitar, the user is opting into losing pseudonymity, seeing as it's pretty trivial to take lists of email addresses you want to hunt down, md5 them, and then check them against places that user gravitar comments to identify comments are made by someone specific )

with this suggestion, every user on every email server that supports it, which would likely include all the common large ones if the author had their way, would fall afoul of constant identity leakage across every service they use.

an adversary need only crawl different services and hash the user avatars, spam email servers with requests for addresses dropped in leaks or otherwise available publicly, and match them up to remove privacy from the internet

I don't understand how this opt-in email tied service which you or your email provider has to implement is in any way preventing you from having disconnected identities online.

If you own a domain and your disconnected identities are all tied to the same domain (or email address) then you have exactly the same issue.

this leaks the identity through the services. you can't normally get an email address or verify who someone on twitter or whatever is unless the user specifically chooses to share it.

you could use this to query the email server, and to crawl various services to match up identities across them.

most users do not own their own domains, and this would have to be implemented on the major free email providers to be useful, offering up every user on them for casual identification via any service that displays their image

But ... the email provider can't force you to give them a picture of you. I mean... unless they force you to give them _a picture_ and then do verification to check that it's you. Which is never going to happen.