Gravatar is linked to email address. If I enter somebody else's email - I can use his/her photo as avatar and that someone won't like it.
So the obvious solution is - validate email - which some other people will not like either.
The question is - is it worth setting up email validation for the purpose of making sure that stealing avatar would be harder?
I hope this question is appropriate here...
Thx.
If you simply submit somebody else's photo to gravatar and link it to an email address of your choosing, you can use their photo as your avatar. No amount of email verification will prevent that.
Are you sure you're solving a problem that actually exists?
The question is - is it worth setting up email validation for the purpose of making sure that stealing avatar would be harder?
The answer is probably no. Because stealing someone's avatar is as easy as right-clicking the image and choosing save. It is not something that is meant to be protected.
But what about the problem of preventing someone from using their email linked gravatar b/c you have signed up with their email. The only way is verification, but I don't think the costs of verification outweigh the benefits of preventing this problem. It is very rare, and email verification is a big pain for users.