Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Protecting your email address via SVG instead of JavaScript

rouninmedia.github.io

Post reply on HN
Print view View original

51–60 of 180 posts

Re: Protecting your email address via SVG instead of JavaScript

#51

Post by gostsamo »

rrr_oh_man wrote: post #47
gostsamo wrote: post #10

Earlier quoted context omitted.

I tested and seems accessible on the live demo. Not sure if is as protected as the author claims though, but it might throw some bots for a spin.

Man, I’ve always wondered how to test apps with a (simulated) screen reader, but never got too far

My secret is that I'm not simulating. Being blind forces you into it. :D

For testing purposes, the nvda screen reader is free and open source. I'm not sure if there is a driver for it to have an api access to what it would output, but it might be a fun project to try for a11y testing purposes.

Re: Protecting your email address via SVG instead of JavaScript

#52

Post by giantrobot »

simondotau wrote: post #37
gwervc wrote: post #26

Earlier quoted context omitted.

[flagged]

This isn't an issue with Firefox, it's a consequence of the NoScript extension blocking unsafe features. The behaviour is likely same/similar with NoScript and Chrome. Chrome is the new MSIE. In both cases, a dominant position was used to dictate web standards in an unhealthy way. Microsoft did it through strategic neglect. Google is doing it by strategic smothering. Firefox and Safari are the web's last stand agains…

> against Google endlessly ramming new features down our throats and declaring them "standards".

New features that will be used for their intended purpose maybe 1% of the time and fingerprinting by AdTech the rest of the time. What could possibly go wrong handing the Web over to an advertising company?

Re: Protecting your email address via SVG instead of JavaScript

#53

Post by miki123211 »

While there's nothing stopping this technique from being accessible in principle, the example given in the article is a really bad one.

The article uses "Email us!" as the label on the svg and a elements, which effectively hides the actual email address from screen readers. Using aria labels in this way is a really bad practice, a screen reader user should have the same experience as anybody else unless there's a very good reason to do otherwise, and if you think your reason is a good reason, you're probably wrong.

The proper way to do this would be to put the actual email address in the labels,.

Re: Protecting your email address via SVG instead of JavaScript

#54

Post by 47282847 »

miki123211 wrote: post #53

While there's nothing stopping this technique from being accessible in principle, the example given in the article is a really bad one. The article uses "Email us!" as the label on the svg and a elements, which effectively hides the actual email address from screen readers. Using aria labels in this way is a really bad practice, a screen reader user should have the same experience as anybody else unless there's a ver…

Isn’t the whole point of the exercise to not have the document contain the email address in a (machine-)readable format?

Re: Protecting your email address via SVG instead of JavaScript

#56

Post by Doe-_ »

47282847 wrote: post #54
miki123211 wrote: post #53

While there's nothing stopping this technique from being accessible in principle, the example given in the article is a really bad one. The article uses "Email us!" as the label on the svg and a elements, which effectively hides the actual email address from screen readers. Using aria labels in this way is a really bad practice, a screen reader user should have the same experience as anybody else unless there's a ver…

Isn’t the whole point of the exercise to not have the document contain the email address in a (machine-)readable format?

The email address wouldn't be in the document directly, only in the SVG. Whether the title of the SVG contains "Email us" or the email address wouldn't affect how it works.

If the scrapper is searching the DOM rather than simply downloading the webpages, then the email will found regardless.

Re: Protecting your email address via SVG instead of JavaScript

#58

Post by nolok »

shanehoban wrote: post #39
cwillu wrote: post #2

Email is still plain-text within an xml document referenced in the page source.

Try to query it though via document.querySelectorAll('a') for example. It's a good first line of defense as a lot of scraping techniques do this approach. However, if you have a headless browser setup for scraping, and simply fetch the current URL while on the page[0], you can get the plain text, and do a regex search for email addresses which will get you the email address - albeit this is a strange approach to take…

> It's a good first line of defense as a lot of scraping techniques do this approach.

Most basic scrappers, the ones that are not for your testing or devtools or automation or ... Actually use basic text, without any interpretation. They grep the source code, they don't run a dom and javascript engine, because it's a major difference in computing needs and speed.

I am not saying there is no evil scrapper doing dom evaluation, there are tons, I am reacting to your "FIRST line of defense", that one is scrambling the raw text, which is why we got there.

What parent is saying, is that this is trying to upgrade the defense that we have generated to stop the threat that evolved, but it forgot why we got there and thus makes itself vulnerable to the original threat.

Re: Protecting your email address via SVG instead of JavaScript

#59

Post by zigzag312 »

cyptus wrote: post #20

there is a quite big stackoverflow discussion about ideas how to protect your email on your website: https://stackoverflow.com/q/163628/1216595

Sadly stackoverflow closed the discussion. Even though discussion is both interesting and valuable.

Re: Protecting your email address via SVG instead of JavaScript

#60

Post by edave64 »

turboturbo wrote: post #32
_joel wrote: post #21

Earlier quoted context omitted.

The idea being that spam bots don't parse svg's looking for email addresses, just the page html. I'm not sure how effective this really is with modern spam protection, however.

The idea also seem to be that spam bots don’t look for `href="mailto:something"` in the DOM

The mailto is inside the SVG, not the HTML document. So that's not "also" it's the same idea of bots not looking at the svg at all
Post reply on HN