Live data from Hacker News

Protecting your email address via SVG instead of JavaScript

rouninmedia.github.io

61–70 of 180 posts

Re: Protecting your email address via SVG instead of JavaScript

#61
I tested the example using the TalkBack screenreader on Android. With Firefox I was able to select and click on the link, but it did not announce the email address. With Chromium it completely ignored the existence of the SVG email. I was unable to select it and it was like the email wasn't there at all.

So yeah, I wouldn't call this accessible.

Re: Protecting your email address via SVG instead of JavaScript

#62
> Email addresses published on webpages usually need to be protected from email-harvesting spambots.

Do they though?

I have had my email address published on my website in a I use both Gmail and (for some other addresses) a webmail hosted by a local company which uses some other filter. Both work well, so it's not something only Google can do.

Re: Protecting your email address via SVG instead of JavaScript

#63
post #9

> even when a human visitor has their JavaScript turned off, the email address displayed on the page remains usable NoScript on Firefox with default settings don't render tags (replaces them with placeholders), so this technique doesn't work here. https://imgur.com/2tCAgAf

it's the same in chromium.

Re: Protecting your email address via SVG instead of JavaScript

#64
post #13
post #8

I don't get it, I can just curl the svg and grep for mailto?

Yes, but these scrapper bots aren't that sophisticated.

Crawl every link, now including SVG, and grep all 'mailto:' does not sound super sophisticated?

    wget --recursive --quiet $BASE_URL && grep -roh 'mailto:\([^"]*\)'
works on the example and just prints the email

Re: Protecting your email address via SVG instead of JavaScript

#66
post #64
post #13

Earlier quoted context omitted.

Yes, but these scrapper bots aren't that sophisticated.

Crawl every link, now including SVG, and grep all 'mailto:' does not sound super sophisticated? wget --recursive --quiet $BASE_URL && grep -roh 'mailto:\([^"]*\)' works on the example and just prints the email

I think the idea is that email scraper bots typically don't bother downloading images referenced by tags.

Re: Protecting your email address via SVG instead of JavaScript

#67

While there's nothing stopping this technique from being accessible in principle, the example given in the article is a really bad one. The article uses "Email us!" as the label on the svg and a elements, which effectively hides the actual email address from screen readers. Using aria labels in this way is a really bad practice, a screen reader user should have the same experience as anybody else unless there's a ver…

This can also affect voice dictation software like Dragon - if a user says 'Click myemail@mydomain.tld' it won't activate the link as Dragon is expecting 'Click email us', as that's now what the browser exposes as the link text.

That point might be academic anyway as I'm not sure Dragon would activate a link inside an SVG

Re: Protecting your email address via SVG instead of JavaScript

#68
Is there really a point to any of this? It's a fun exercise, but also a complete waste of time if you're actually trying to hide from spammers. You're making a piece of information public by sharing it with the entire world, yet somehow expecting it to only stay accessible to the "good guys".

Unless you change your email address at least monthly, all it takes is for one person or company to share your contact with someone else or enter it into a database/CRM, or one service to get breached, then your email address is on a list that eventually gets propagated to every spammer worldwide. If you use that email with any regularity, the chance of those things happening can be rounded up to 100%.

If hiding your email address from scrapers actually worked, spam wouldn't exist. I never published my personal contact anywhere, yet I get dozens of spam emails per week. They all get filtered as spam, it's not a big deal.

Re: Protecting your email address via SVG instead of JavaScript

#69
post #58

Earlier quoted context omitted.

Try to query it though via document.querySelectorAll('a') for example. It's a good first line of defense as a lot of scraping techniques do this approach. However, if you have a headless browser setup for scraping, and simply fetch the current URL while on the page[0], you can get the plain text, and do a regex search for email addresses which will get you the email address - albeit this is a strange approach to take…

> It's a good first line of defense as a lot of scraping techniques do this approach. Most basic scrappers, the ones that are not for your testing or devtools or automation or ... Actually use basic text, without any interpretation. They grep the source code, they don't run a dom and javascript engine, because it's a major difference in computing needs and speed. I am not saying there is no evil scrapper doing dom ev…

If they’re saying it, I think that they’re wrong. One of those naively written scrapers won’t pick up an email address ‘protected’ in this way. It’s simply continuing the game of cat and mouse.

Re: Protecting your email address via SVG instead of JavaScript

#70
Heavily guarded fortress would indicate something of value inside, and the big crooks may spend a little more effort. In the age of AI, this becomes even easier.

   {
     "model" : "gpt-4-turbo",
     "messages" : [ 
       {
         "role" : "system",
         "content" : [ {
          "type" : "text",
          "text" : "return a json array of all valid emails found in the image."
          } ] 
       }, 
       {
         "role" : "user",
         "content" : [ {
           "type" : "image_url",
           "image_url" : {
           "url" : "data:image/png;base64,{{ INSERT_BASE64_PNG_DATA }}"
         }
       } ]
     } ],
      "temperature" : 0.5,
      "max_tokens" : 2048,
      "top_p" : 1.0,
      "frequency_penalty" : 0.0,
      "presence_penalty" : 0.0
    }
Edit: Converting web page to an image is trivial.
Post reply on HN