3 ms·

I just hope they don't start caching and displaying obfuscated links, since JavaScript obfuscation is how I currently manage to display a working mailto: link o

by Niten 16y ago

I just hope they don't start caching and displaying obfuscated links, since JavaScript obfuscation is how I currently manage to display a working mailto: link on my personal web page while simultaneously giving myself nominal protection from address harvesters. Is this no longer a viable strategy for protecting one's email address on the web?

JoachimSchipper 16y ago
To the extent that it ever worked, it still works - Google doesn't index mailto: links.
- mootothemax 16y ago
  Do you know that for a fact? Just because something's not publically available doesn't mean it's not in the back-end.
  - JoachimSchipper 16y ago
    I don't know whether or not they are in Google's data center somewhere; but to the best of my knowledge, they cannot be extracted from that data center, which means it's largely irrelevant as far as spam is concerned.
acdha 16y ago
This was never more than a minor delaying tactic: spammers have been capable of running JS for a long time (harvesters embedding IE via ActiveX have been around for at least a decade) but there hasn't been much pressure to do this since they still got billions of addresses which weren't obfuscated or were obtained by other means. I'll also note that I've never obfuscated my email address (chris@improbable.org) and spam arrived in roughly equal volumes there and to less public addresses which were guessable (except for test accounts created with MD5 hashes[1]). People do harvest addresses from web pages but there are enough other ways spammers get addresses that you need a robust filter in any case; once you have something like SpamAssassin or Google's filters, the value of keeping your address private disappears. [1] That also yielded the interesting datapoint that hotmail used to sell addresses to spammers in early last decade as the first spam arrived within 20 minutes to a long, random address created with the "don't publish my info" option.
spokey 16y ago
I do this too, and despite what other replies here suggest, anecdotally it does seem to work. My approach is a little more convoluted than simply document.write or something like that, so maybe that matters. I get crawled by bad bots all the time, but these addresses never seem to get spammed. The same is not true for addresses displayed in plain-text somewhere. My explanation has always been that there are so many plain-text addresses on the web that it isn't necessary to add JavaScript parsing logic to most harvesters. Much like car alarms or door locks--you don't need to make them unbreakable, simple harder to get at than the one next door. Someday we may need to start displaying email addresses as (or behind) captchas.

by Niten 16y ago

JoachimSchipper 16y ago

To the extent that it ever worked, it still works - Google doesn't index mailto: links.

mootothemax 16y ago
Do you know that for a fact? Just because something's not publically available doesn't mean it's not in the back-end.
- JoachimSchipper 16y ago
  I don't know whether or not they are in Google's data center somewhere; but to the best of my knowledge, they cannot be extracted from that data center, which means it's largely irrelevant as far as spam is concerned.

acdha 16y ago

This was never more than a minor delaying tactic: spammers have been capable of running JS for a long time (harvesters embedding IE via ActiveX have been around for at least a decade) but there hasn't been much pressure to do this since they still got billions of addresses which weren't obfuscated or were obtained by other means. I'll also note that I've never obfuscated my email address (chris@improbable.org) and spam arrived in roughly equal volumes there and to less public addresses which were guessable (except for test accounts created with MD5 hashes[1]). People do harvest addresses from web pages but there are enough other ways spammers get addresses that you need a robust filter in any case; once you have something like SpamAssassin or Google's filters, the value of keeping your address private disappears. [1] That also yielded the interesting datapoint that hotmail used to sell addresses to spammers in early last decade as the first spam arrived within 20 minutes to a long, random address created with the "don't publish my info" option.

spokey 16y ago

I do this too, and despite what other replies here suggest, anecdotally it does seem to work. My approach is a little more convoluted than simply document.write or something like that, so maybe that matters. I get crawled by bad bots all the time, but these addresses never seem to get spammed. The same is not true for addresses displayed in plain-text somewhere. My explanation has always been that there are so many plain-text addresses on the web that it isn't necessary to add JavaScript parsing logic to most harvesters. Much like car alarms or door locks--you don't need to make them unbreakable, simple harder to get at than the one next door. Someday we may need to start displaying email addresses as (or behind) captchas.