4 ms·

Would using a scheme similar to what I'm using in my profile help you? Or describe it in natural language: my twitter handle is my first name and last name conc

Would using a scheme similar to what I'm using in my profile help you? Or describe it in natural language: my twitter handle is my first name and last name concatenated. My email address is my twitter handle on Gmail. I think this would help.

ColinWright 6y ago
I've been on the 'net for over 35 years, and every scheme I've seen has either been impenetrable for some genuine users, or eventually compromised, including the one you have there. I had pretty much exactly that scheme at one point, and it got compromised. If yours hasn't yet then you're lucky. Personally, I've found that obscuring my email results in greater losses than gains, and having excellent filtering is the better strategy.
- Jugurtha 6y ago
  Are we talking about harvesting from automated tools? If yes, do you reckon automated tools mostly miss emails communicated through these schemes? What do you mean by the scheme being compromised? An automated tool harvested it? Do you have any information on the possibility of harvesters with human in the loop? I can see some "shop" having human harvester who get paid by the number of addresses they "harvest". Regarding genuine users having difficulty.. What would you say the rates are? Genuine users unable to read emails from schemes vs automated tools unable to extract emails from ad-hoc schemes. What would you say the benefit is from having a plain e-mail address given the likelihood of it being "harvested"?
  - ColinWright 6y ago
    I'm pretty sure that email obfuscation schemes such as you are using don't fool modern email harvesting 'bots. In fact, I know they don't, because there are 'bots out there that find text strings in proximity to an "@" sign and then try that text as the username against the domain that they've seen. I know that happens, because I've laid honeypots and seen it. So your method is not proof against being harvested by 'bots, and if it hasn't yet, it's because those 'bots haven't scanned your profile. Yet. This is no doubt then bolstered by having humans doing grunt work -- we know that happens too. With regards real humans having problems, there's no reliable way to estimate the rate, but I run an event every year, and every year there are a handful of people who can't cope with an address that requires anything more than just clicking on a link. I'm guessing around 5 to 10 out of 200 to 300. I use primarily plain email addresses, and then strengthen my filtering to make sure the 'bots don't get through. Mostly. That's the failure mode I've chosen. You could decide that if someone isn't "smart enough" to decode your obfuscated address then you don't want to hear from them. That's a choice. The important thing is to know you're making it, and to evaluate the consequences.

ColinWright 6y ago

I've been on the 'net for over 35 years, and every scheme I've seen has either been impenetrable for some genuine users, or eventually compromised, including the one you have there. I had pretty much exactly that scheme at one point, and it got compromised. If yours hasn't yet then you're lucky. Personally, I've found that obscuring my email results in greater losses than gains, and having excellent filtering is the better strategy.

Jugurtha 6y ago
Are we talking about harvesting from automated tools? If yes, do you reckon automated tools mostly miss emails communicated through these schemes? What do you mean by the scheme being compromised? An automated tool harvested it? Do you have any information on the possibility of harvesters with human in the loop? I can see some "shop" having human harvester who get paid by the number of addresses they "harvest". Regarding genuine users having difficulty.. What would you say the rates are? Genuine users unable to read emails from schemes vs automated tools unable to extract emails from ad-hoc schemes. What would you say the benefit is from having a plain e-mail address given the likelihood of it being "harvested"?
- ColinWright 6y ago
  I'm pretty sure that email obfuscation schemes such as you are using don't fool modern email harvesting 'bots. In fact, I know they don't, because there are 'bots out there that find text strings in proximity to an "@" sign and then try that text as the username against the domain that they've seen. I know that happens, because I've laid honeypots and seen it. So your method is not proof against being harvested by 'bots, and if it hasn't yet, it's because those 'bots haven't scanned your profile. Yet. This is no doubt then bolstered by having humans doing grunt work -- we know that happens too. With regards real humans having problems, there's no reliable way to estimate the rate, but I run an event every year, and every year there are a handful of people who can't cope with an address that requires anything more than just clicking on a link. I'm guessing around 5 to 10 out of 200 to 300. I use primarily plain email addresses, and then strengthen my filtering to make sure the 'bots don't get through. Mostly. That's the failure mode I've chosen. You could decide that if someone isn't "smart enough" to decode your obfuscated address then you don't want to hear from them. That's a choice. The important thing is to know you're making it, and to evaluate the consequences.