.well-known/avatar
avatar IETF open standards standards · 24 comments · 400 words · Viewed ~1,833 times.
Hot on the heels of a post I wrote 4 years ago, wouldn't it be useful to have a well-known URl for user avatar images?
When I sign up to a web service, I don't want to faff around uploading an image to use as my avatar. I want that service to look at my email address or social-sign-in and automatically pick up my preferred graphic.
Here's how I see it working.
- A user signs in to a service with the email address
username@example.com - In a similar way to WebFinger, the service makes a request to:
example.com/.well-known/avatar?resource=acct:username@example.com
- If the request's
Acceptheader has a MIME type ofimage/*, then the server immediately returns an image. - If the request's
Acceptheader has a MIME type ofapplication/json, then the server can return a WebFinger-style document with"rel":"http://webfinger.net/rel/avatar"and, perhaps, a list of different images, formats, and sizes.
This makes it incredibly simple for people to use the same avatar everywhere.
It also means that if you're designing a service which publicly shows usernames, you can make avatars available without an expensive API call. For example, Twitter could make user's avatars available at:
twitter.com/.well-known/avatars?resource=acct:edent
But what about...?
This is a sketch of an idea. I'd like to know if people think it is useful before I take it any further.
I don't think it breaches privacy - a user's image is public on all services anyway.
Users should still be given the option of changing their avatar if they want.
A service shouldn't expose the user's email address - they should proxy the image.
Anything else I should have thought of?
Updates
To stave off some common points raised.
- No this isn't like Gravatar. That works by being a 3rd party service and using the MD5 of your email address.
- No this isn't like Libravatar. See above.
- No this isn't like WebFinger. That only returns JSON.
- No this isn't like h-card. That requires a server to parse HTML in order to find an image.
- No this isn't like BIMI. That's expensive and only supports SVG.
Alex Chamberlain says:
@edent says:
.well-known, and it has so much promise.still has the whole "domain as price of entry", but that's something that could be worked on (IaaS)True. But I'm not sure how I discover a h-card without requesting and then parsing HTML.
I'm think of this as a way to simplify things.
I do like that gravatar supports multiple emails though and optional different inages for each, but all under one account. It does expose my email matches another account potentially though, which I may not want to share
Mohammad Hossein Mojtahedi says:
@edent says:
Kevin S says:
@edent says:
@edent says:
Did you take this any further @edent? With Wordpress (& hence gravatar?) feuding with its own ecosystem it seems prudent to revisit!
I’m a little cautious about using plain text to lookup the email, as it exposes all your email addresses by inspection of a static site’s code (or if a site that uses this mechanism doesn’t proxy, so exposes your otherwise private signup email).
Using a hash of the email instead of the email’s local-part to resolve this (à la gravatar) still allows a fairly easy approach to uncovering email addresses (seek hash collisions), but I guess a person could just not use this method if an email address needs to be harder than that to sniff out.
More comments on Mastodon.