4 ms·

Are we talking about harvesting from automated tools? If yes, do you reckon automated tools mostly miss emails communicated through these schemes? What do you

Are we talking about harvesting from automated tools? If yes, do you reckon automated tools mostly miss emails communicated through these schemes? What do you mean by the scheme being compromised? An automated tool harvested it? Do you have any information on the possibility of harvesters with human in the loop? I can see some "shop" having human harvester who get paid by the number of addresses they "harvest". Regarding genuine users having difficulty.. What would you say the rates are? Genuine users unable to read emails from schemes vs automated tools unable to extract emails from ad-hoc schemes. What would you say the benefit is from having a plain e-mail address given the likelihood of it being "harvested"?

ColinWright 6y ago
I'm pretty sure that email obfuscation schemes such as you are using don't fool modern email harvesting 'bots. In fact, I know they don't, because there are 'bots out there that find text strings in proximity to an "@" sign and then try that text as the username against the domain that they've seen. I know that happens, because I've laid honeypots and seen it. So your method is not proof against being harvested by 'bots, and if it hasn't yet, it's because those 'bots haven't scanned your profile. Yet. This is no doubt then bolstered by having humans doing grunt work -- we know that happens too. With regards real humans having problems, there's no reliable way to estimate the rate, but I run an event every year, and every year there are a handful of people who can't cope with an address that requires anything more than just clicking on a link. I'm guessing around 5 to 10 out of 200 to 300. I use primarily plain email addresses, and then strengthen my filtering to make sure the 'bots don't get through. Mostly. That's the failure mode I've chosen. You could decide that if someone isn't "smart enough" to decode your obfuscated address then you don't want to hear from them. That's a choice. The important thing is to know you're making it, and to evaluate the consequences.

ColinWright 6y ago

I'm pretty sure that email obfuscation schemes such as you are using don't fool modern email harvesting 'bots. In fact, I know they don't, because there are 'bots out there that find text strings in proximity to an "@" sign and then try that text as the username against the domain that they've seen. I know that happens, because I've laid honeypots and seen it. So your method is not proof against being harvested by 'bots, and if it hasn't yet, it's because those 'bots haven't scanned your profile. Yet. This is no doubt then bolstered by having humans doing grunt work -- we know that happens too. With regards real humans having problems, there's no reliable way to estimate the rate, but I run an event every year, and every year there are a handful of people who can't cope with an address that requires anything more than just clicking on a link. I'm guessing around 5 to 10 out of 200 to 300. I use primarily plain email addresses, and then strengthen my filtering to make sure the 'bots don't get through. Mostly. That's the failure mode I've chosen. You could decide that if someone isn't "smart enough" to decode your obfuscated address then you don't want to hear from them. That's a choice. The important thing is to know you're making it, and to evaluate the consequences.