7 ms·

ReCAPTCHA Mailhide

30 points by cskau 15y ago

tomjen3 15y ago
A horrible idea -- those who really want your email will just get it when there is a leak at some big site (ala slicehost forum) and the people you most want to get news from won't take the time to get your email (except if you are very famous). If you are that concerned about spam, let Google handle it -- get your own domain if you want -- and you don't have to worry too much about it. justtoproveapoint-neverusedthisbefore@tomjen.net.
dpkendal 15y ago
Far more user-friendly is Dan Benjamin's Enkoder. http://hivelogic.com/enkoder/ http://hivelogic.com/enkoder/ It requires that JavaScript be enabled for users, but blocks a large number of spam bots.
cj 15y ago
Is the benefit worth the inconvenience? I've had my email in plain text on my personal site for the last 2 years and haven't noticed an increase in spam (thanks to gmail, I suspect).
- rogerbinns 15y ago
  I've had mine on the Internet for well over a decade and run my own mail server. Plus it is a catch all domain - anything before the @ goes to me. My mail server is configured to be deliberately slow - taking a few seconds extra here or there to respond to SMTP commands. This catches out the spammers who just spew traffic at you ignoring the protocol. Checking sender domains actually exist plus the Zen RBL gets almost everything else. The dribble that gets through all that then goes to spamassassin which does a sterling job. (I make it put messages scoring 5-7 points in a special folder I manually examine every now and then to double check its effectiveness.) About the only problem I have had are bad recruiters who have made zero effort to ensure I am match for their client or vice versa. I even have a "Note to recruiters" prominently displayed on my resume, but of course the bad ones aren't going to bother reading that. I have to maintain a list of their domains to block since that appears to be the only way to stop them. (Currently 45 entries and counting ...)
  - pagekalisedown 15y ago
    Would you be willing to share your list of bad recruiters?
    - rogerbinns 15y ago
      I've been threatening to do it for years, and I guess this is as good a time as any. Note of course that this is based on my experience. http://www.rogerbinns.com/blocked_recruiters.txt http://www.rogerbinns.com/blocked_recruiters.txt This is my "Note to recruiters" http://www.rogerbinns.com/recruiters.html http://www.rogerbinns.com/recruiters.html
      - pagekalisedown 15y ago
        "As any group of people gets larger, they get collectively slower and collectively stupider." Amen! My personal threshold is around 100 people. Pass 100, and you quickly dive into Dilbert territory.
        rogerbinns 15y ago
        > My personal threshold is around 100 people That is probably highly correlated with Dunbar's number http://en.wikipedia.org/wiki/Dunbars_number http://en.wikipedia.org/wiki/Dunbars_number
        pagekalisedown 15y ago
        Very enlightening article, thank you!
- hasantayyar 15y ago
  This is not only for your own email on your site. Especially on comminity sites your you can protect your users' emails with mailhide API http://code.google.com/apis/recaptcha/docs/mailhideapi.html http://code.google.com/apis/recaptcha/docs/mailhideapi.html
niklaslogren 15y ago
It seems the site's encoding is broken somehow. I see only question marks, instead of the å's, ä's and ö's it should display. (Trying to view the Swedish version)
- und3f 15y ago
  Same on Russian page.
codesuela 15y ago
ReCAPTHA has become such a huge pain to solve. Personally I wouldn't even bother solving their horrible captcha to get your email unless I REALLY REALLY need it.
natesm 15y ago
Although, if you are hosting your email with Google already, it seems kind of irrelevant. I happily post my email in `mailto:` form, and I get spam infrequently enough to happily read through it and laugh at the contents when I do (it's always the funny ones that make it through).
- pyre 15y ago
  I'm curious why people bother with these posts anymore. It's like some sort of (self) identity validation. E.g. "Look! I sided with Google and I'm on the winning side!"
ChrisArchitect 15y ago
this has been around for years no? Also, in recent months I've started to move away from using reCaptcha everywhere on webform deployments because of increased difficulty from, shall we say, the less patient and computer literate, visitors of my sites.
unicornporn 15y ago
Example: show hello@yourdomain.com in plain text on your site and let it pass Gmail's spam filter but send the reply from yourname@yourdomain.com if you get a non-spam message. Use Enkoder ( http://hivelogic.com/enkoder/ http://hivelogic.com/enkoder/ ) if you're really spam sensitive.
finnw 15y ago
There's an older trick that still works for me: a passphrase in the subject line. You can even include the passphrase in the mailto: uri. E-mail harvesters usually discard it, but a user who clicks the link (e.g. to compose a message in Thunderbird) will have their subject field populated. Now set up procmail to redirect messages to /dev/null if the passphrase is not present. Now you can freely post the uri all over the web. Real example: mailto:aoxomoxoa@finnw.me.uk?subject=Don%22t+buy+this (I'm confident that no spammer will send bulk messages with "Don't buy this" in the subject line, so that makes a good default passphrase.)
- kijin 15y ago
  I know someone who always changes the subject line to reflect the content. He even changes the subject line when responding to other people's e-mails, which is quite annoying because it often breaks Gmail conversations. So you'll have to take some measure to tell people not to delete that passphrase from the subject line. For example, "Don't change or delete this or it will go into my spam box." But that's verbose.
  - finnw 15y ago
    If I send a reply, it comes from a different address (which is not published and is unaffected by the procmail recipe)
NameNickHN 15y ago
This is just another stupid hurdle that people are required to jump over if they want to use the internet. If you offer products or services over the internet, stay clear of captcha. Unless, of course, you give a dam about your conversion rate. Spam filters are effective enough to keep your inbox clean. There is no need to play hide and seek with email harvester bots.

30 points by cskau 15y ago

A horrible idea -- those who really want your email will just get it when there is a leak at some big site (ala slicehost forum) and the people you most want to get news from won't take the time to get your email (except if you are very famous). If you are that concerned about spam, let Google handle it -- get your own domain if you want -- and you don't have to worry too much about it. justtoproveapoint-neverusedthisbefore@tomjen.net.

dpkendal 15y ago

Far more user-friendly is Dan Benjamin's Enkoder. http://hivelogic.com/enkoder/ http://hivelogic.com/enkoder/ It requires that JavaScript be enabled for users, but blocks a large number of spam bots.

cj 15y ago

Is the benefit worth the inconvenience? I've had my email in plain text on my personal site for the last 2 years and haven't noticed an increase in spam (thanks to gmail, I suspect).

rogerbinns 15y ago
I've had mine on the Internet for well over a decade and run my own mail server. Plus it is a catch all domain - anything before the @ goes to me. My mail server is configured to be deliberately slow - taking a few seconds extra here or there to respond to SMTP commands. This catches out the spammers who just spew traffic at you ignoring the protocol. Checking sender domains actually exist plus the Zen RBL gets almost everything else. The dribble that gets through all that then goes to spamassassin which does a sterling job. (I make it put messages scoring 5-7 points in a special folder I manually examine every now and then to double check its effectiveness.) About the only problem I have had are bad recruiters who have made zero effort to ensure I am match for their client or vice versa. I even have a "Note to recruiters" prominently displayed on my resume, but of course the bad ones aren't going to bother reading that. I have to maintain a list of their domains to block since that appears to be the only way to stop them. (Currently 45 entries and counting ...)
- pagekalisedown 15y ago
  Would you be willing to share your list of bad recruiters?
  - rogerbinns 15y ago
    I've been threatening to do it for years, and I guess this is as good a time as any. Note of course that this is based on my experience. http://www.rogerbinns.com/blocked_recruiters.txt http://www.rogerbinns.com/blocked_recruiters.txt This is my "Note to recruiters" http://www.rogerbinns.com/recruiters.html http://www.rogerbinns.com/recruiters.html
    - pagekalisedown 15y ago
      "As any group of people gets larger, they get collectively slower and collectively stupider." Amen! My personal threshold is around 100 people. Pass 100, and you quickly dive into Dilbert territory.
      - rogerbinns 15y ago
        > My personal threshold is around 100 people That is probably highly correlated with Dunbar's number http://en.wikipedia.org/wiki/Dunbars_number http://en.wikipedia.org/wiki/Dunbars_number
        pagekalisedown 15y ago
        Very enlightening article, thank you!
hasantayyar 15y ago
This is not only for your own email on your site. Especially on comminity sites your you can protect your users' emails with mailhide API http://code.google.com/apis/recaptcha/docs/mailhideapi.html http://code.google.com/apis/recaptcha/docs/mailhideapi.html

niklaslogren 15y ago

It seems the site's encoding is broken somehow. I see only question marks, instead of the å's, ä's and ö's it should display. (Trying to view the Swedish version)

und3f 15y ago
Same on Russian page.

codesuela 15y ago

ReCAPTHA has become such a huge pain to solve. Personally I wouldn't even bother solving their horrible captcha to get your email unless I REALLY REALLY need it.

natesm 15y ago

Although, if you are hosting your email with Google already, it seems kind of irrelevant. I happily post my email in `mailto:` form, and I get spam infrequently enough to happily read through it and laugh at the contents when I do (it's always the funny ones that make it through).

pyre 15y ago
I'm curious why people bother with these posts anymore. It's like some sort of (self) identity validation. E.g. "Look! I sided with Google and I'm on the winning side!"

ChrisArchitect 15y ago

this has been around for years no? Also, in recent months I've started to move away from using reCaptcha everywhere on webform deployments because of increased difficulty from, shall we say, the less patient and computer literate, visitors of my sites.

unicornporn 15y ago

Example: show hello@yourdomain.com in plain text on your site and let it pass Gmail's spam filter but send the reply from yourname@yourdomain.com if you get a non-spam message. Use Enkoder ( http://hivelogic.com/enkoder/ http://hivelogic.com/enkoder/ ) if you're really spam sensitive.

finnw 15y ago

There's an older trick that still works for me: a passphrase in the subject line. You can even include the passphrase in the mailto: uri. E-mail harvesters usually discard it, but a user who clicks the link (e.g. to compose a message in Thunderbird) will have their subject field populated. Now set up procmail to redirect messages to /dev/null if the passphrase is not present. Now you can freely post the uri all over the web. Real example: mailto:aoxomoxoa@finnw.me.uk?subject=Don%22t+buy+this (I'm confident that no spammer will send bulk messages with "Don't buy this" in the subject line, so that makes a good default passphrase.)

kijin 15y ago
I know someone who always changes the subject line to reflect the content. He even changes the subject line when responding to other people's e-mails, which is quite annoying because it often breaks Gmail conversations. So you'll have to take some measure to tell people not to delete that passphrase from the subject line. For example, "Don't change or delete this or it will go into my spam box." But that's verbose.
- finnw 15y ago
  If I send a reply, it comes from a different address (which is not published and is unaffected by the procmail recipe)

NameNickHN 15y ago

This is just another stupid hurdle that people are required to jump over if they want to use the internet. If you offer products or services over the internet, stay clear of captcha. Unless, of course, you give a dam about your conversion rate. Spam filters are effective enough to keep your inbox clean. There is no need to play hide and seek with email harvester bots.