Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Protecting your email address via SVG instead of JavaScript

rouninmedia.github.io

Post reply on HN
Print view View original

31–40 of 180 posts

Re: Protecting your email address via SVG instead of JavaScript

#31

Post by StrauXX »

gwervc wrote: post #26
magnat wrote: post #9

> even when a human visitor has their JavaScript turned off, the email address displayed on the page remains usable NoScript on Firefox with default settings don't render tags (replaces them with placeholders), so this technique doesn't work here. https://imgur.com/2tCAgAf

[flagged]

Firefox is not at all the new IE. Firefox isn't worse at implementing the spec than Chrome they just make different decisions sometimes. People tend to see Chrome behaviour as the default of how things should be, rather than the specs.

Re: Protecting your email address via SVG instead of JavaScript

#32

Post by turboturbo »

_joel wrote: post #21
cwillu wrote: post #2

Email is still plain-text within an xml document referenced in the page source.

The idea being that spam bots don't parse svg's looking for email addresses, just the page html. I'm not sure how effective this really is with modern spam protection, however.

The idea also seem to be that spam bots don’t look for `href="mailto:something"` in the DOM

Re: Protecting your email address via SVG instead of JavaScript

#33

Post by geuis »

Why? What's the point?

All you're doing I making it slightly more difficult for the people that want to contact you to do so.

OCR has been a thing for years.

Just put your email out there. That's what spam filters are for.

charles@geuis.com. There. Scrape it. Spam it. I don't care.

Edit:

Yes, thank you for signing me up for the DNC (already a member), some random Trump org, something about Scientology, and another random christian-based website. Honestly, I'm kind of sad at the lack of originality given the otherwise extremely ingenious community we have here.

Re: Protecting your email address via SVG instead of JavaScript

#34

Post by richrichardsson »

parasti wrote: post #23
dannyobrien wrote: post #11

I would like to push back on the idea that you should obfuscate your email address at all. My email addreas is danny@spesh.com. I get a lot of spam -- possibly, since I have been distributing that address deliberately on the web and inadvertently in hacked datadumps, a near maximum amount of spam. But the benefits of having people easily find a way to contact me directly has for me far outweighed the (largely solved)…

This is appropriate advice for the average HN reader. For everyone else, probably not. I've seen first hand otherwise intelligent people being unable to discern an obvious (to me) online scam from a legitimate business. These are the people spammers are targeting. These are the people that need to obfuscate their email address.

Even sophicasted users can slip up in the right circumstances.

Personal anecdote: one morning, whilst still quite sleepy received a very well crafted Namecheap phishing expedition. I half knew the product they were claiming was lapsed was actually fine, but I had just recently renewed so I thought perhaps there had been a problem I missed, and it was convincing enough that I clicked the link before doing the normal sanity checks. Thankfully the address it went to didn't resolve. Hopefully I would have noticed the obviously incorrect URL before I entered any details, and I have 2FA enabled, but still, I should and do know better, it was just perfect timing for a well crafted attack...

Re: Protecting your email address via SVG instead of JavaScript

#35

Post by [deleted] »

StrauXX wrote: post #31
gwervc wrote: post #26

Earlier quoted context omitted.

[flagged]

Firefox is not at all the new IE. Firefox isn't worse at implementing the spec than Chrome they just make different decisions sometimes. People tend to see Chrome behaviour as the default of how things should be, rather than the specs.

[deleted]

Re: Protecting your email address via SVG instead of JavaScript

#36

Post by RaoulP »

ale42 wrote: post #27
RaoulP wrote: post #18

Earlier quoted context omitted.

I think so too. And I think the majority of data breaches that have lead to spam for me are from ages ago, from random services I signed up for as a teenager. For a few years after that I did the "+" Gmail alias thing, to try to filter and catch companies. But I realised that's easy and obvious to strip, so it wasn't worth the effort (although I have caught PayPal leaking my email somehow).

If you self-host your email, you can use "." as a delimiter instead of the "+". People would already need to know they can strip that part...

Sounds good! I might go even further and just use a custom address for each service, i.e. paypal@example.com or something.

But self-hosting email is an adventure I'm nervous to embark on.

Re: Protecting your email address via SVG instead of JavaScript

#37

Post by simondotau »

gwervc wrote: post #26
magnat wrote: post #9

> even when a human visitor has their JavaScript turned off, the email address displayed on the page remains usable NoScript on Firefox with default settings don't render tags (replaces them with placeholders), so this technique doesn't work here. https://imgur.com/2tCAgAf

[flagged]

This isn't an issue with Firefox, it's a consequence of the NoScript extension blocking unsafe features. The behaviour is likely same/similar with NoScript and Chrome.

Chrome is the new MSIE. In both cases, a dominant position was used to dictate web standards in an unhealthy way. Microsoft did it through strategic neglect. Google is doing it by strategic smothering. Firefox and Safari are the web's last stand against an impending Chrome browser monoculture, against Google endlessly ramming new features down our throats and declaring them "standards".

Re: Protecting your email address via SVG instead of JavaScript

#38

Post by SushiHippie »

dannyobrien wrote: post #11

I would like to push back on the idea that you should obfuscate your email address at all. My email addreas is danny@spesh.com. I get a lot of spam -- possibly, since I have been distributing that address deliberately on the web and inadvertently in hacked datadumps, a near maximum amount of spam. But the benefits of having people easily find a way to contact me directly has for me far outweighed the (largely solved)…

> in hacked datadumps

https://haveibeenpwned.com/

45 data breaches and 7 pastes

Wow, I don't know if I've ever seen a real address in so many breaches haha

Re: Protecting your email address via SVG instead of JavaScript

#39

Post by shanehoban »

cwillu wrote: post #2

Email is still plain-text within an xml document referenced in the page source.

Try to query it though via document.querySelectorAll('a') for example. It's a good first line of defense as a lot of scraping techniques do this approach.

However, if you have a headless browser setup for scraping, and simply fetch the current URL while on the page[0], you can get the plain text, and do a regex search for email addresses which will get you the email address - albeit this is a strange approach to take I admit.

[0]: fetch('./').then((res) => res.text()).then((text) => console.log(text))

Post reply on HN