I think I get more unsolicited email from related businesses trying to get a foot in the door with my company - I assume they're connecting dots either from LinkedIn or Github (probably both). This is an interesting solution to the problem, but I don't genuinely think that anyone is scraping websites for email addresses anymore. I don't think it's cost effective for the modern spammer.
Protecting your email address via SVG instead of JavaScript
121–130 of 180 posts
Re: Protecting your email address via SVG instead of JavaScript
#122Not only "protecting your email" is pointless like others have already pointed out, it's actively harmful. There are a fair few sites, where most all content is perfectly readable without JS, except things like "1920x1080@60Hz" are displayed as literal "[email protected]" text.
> There are a fair few sites, where most all content is perfectly readable without JS, except things like "1920x1080@60Hz" are displayed as literal "[email protected]" text. Do you have one on hand? That sounds absurd and I've never seen it
Mastodon instances fronted by Cloudflare (with Email Protection on) are good examples.
Re: Protecting your email address via SVG instead of JavaScript
#123> Email addresses published on webpages usually need to be protected from email-harvesting spambots. Do they though? I have had my email address published on my website in a I use both Gmail and (for some other addresses) a webmail hosted by a local company which uses some other filter. Both work well, so it's not something only Google can do.
I've also had my email posted in mailto's in a half dozen places for... a long time. I remember in the early 00's when I'd cargo cult the old "type the whole email out as adrian at adrianpike dot com" thing on forums thinking it would work as some mystical talisman, and it turns out considering emails to be secret isn't worth the time.
Re: Protecting your email address via SVG instead of JavaScript
#124Cool. 1 hour later. Spam-scraper updated to support this.
Exactly
Re: Protecting your email address via SVG instead of JavaScript
#125A friend of mine is an absolute wizard and has been building essentially “responsive images” as SVGs with JS inside. They adapt to their size programmatically. It’s… interesting. The fact that SVGs can even have JS embedded feels both untapped and kind of dangerous.
This has been known in the security community for quite some time.
Re: Protecting your email address via SVG instead of JavaScript
#126A friend of mine is an absolute wizard and has been building essentially “responsive images” as SVGs with JS inside. They adapt to their size programmatically. It’s… interesting. The fact that SVGs can even have JS embedded feels both untapped and kind of dangerous.
That sounds super interesting. Does your friend have a GitHub or site that shows what they’re doing on that front. If so could you post link.
This is super far out of my wheelhouse technically as a backend engineer but it sounds really cool.
Re: Protecting your email address via SVG instead of JavaScript
#127> Email addresses published on webpages usually need to be protected from email-harvesting spambots. Do they though? I have had my email address published on my website in a I use both Gmail and (for some other addresses) a webmail hosted by a local company which uses some other filter. Both work well, so it's not something only Google can do.
They do. My wife lost her 10-year-old Instagram account to a well crafted phishing attack against an email she had published…
Instagram/Meta’s customer support is absolutely atrocious and disgraceful on this front. They basically treat my wife like she’s also a spammer and there’s no way to recover the account or undo any of the changes the spammers made.
It’s hilarious how they ask you to “appeal” a ban by clicking a single button without giving any chance to rectify what the spammers did to her account. Of course their automated bots just reject your appeal almost instantly. Shameful.
Re: Protecting your email address via SVG instead of JavaScript
#128> Email addresses published on webpages usually need to be protected from email-harvesting spambots. Do they though? I have had my email address published on my website in a I use both Gmail and (for some other addresses) a webmail hosted by a local company which uses some other filter. Both work well, so it's not something only Google can do.
They do. My wife lost her 10-year-old Instagram account to a well crafted phishing attack against an email she had published… Instagram/Meta’s customer support is absolutely atrocious and disgraceful on this front. They basically treat my wife like she’s also a spammer and there’s no way to recover the account or undo any of the changes the spammers made. It’s hilarious how they ask you to “appeal” a ban by clicking…
This gave me "Press F to appeal ban" images.
Re: Protecting your email address via SVG instead of JavaScript
#129Funny I'm seeing this now, I've finally ade the first tentative steps into making a website, and noticed that pandoc has an --email-obfuscation option and the whole topic was on my mind. I don't remember the last time I received an actual spam email (not counting desparate marketters trying to remind me of that one website I tried ages ago). Funnily enough, the new frontier seems to be what's app and SMS of all things. A month or two back I got a job offer from an indonesian phonenumber from what's app, and then something similar directly to my SMS. I didn't publish my phone number anywhere online, the closest thing to making it public was joining my college's what's app group and giving my phone number to a bank for a student credit card, and honestly I wouldn't put leaking them to some spam agency beyond either.
I'm using voice over on MacOS chromium and I have the same experience as the NVDA user, although if I interact with the "link" I'll eventually find the email. If I wasn't aware of the ofuscation however I probably would just think the webpage was weird, saying "this is an email" but actually giving a mailto: link. In general, if you're doing something special to improve accessibility then odds are you're doing it wrong, and if it's anything web related the odds are at least 90%. Most accessibility issues on the internet are developers trying to be smart by using ARIA labels or such which usually just make it worse. The example I have to deal with most often are manpages on man.openbsd.org. All of their cross references to other manpages say something like "openssl, section 1" instead of "openssl(1)", which is what's displayed on the screen and what the browser's find command sees while searching.
For completeness, I also tried the page with various terminal browsers, specifically lynx, felinks, w3m, and edbrowse. None, and I mean NONE of them could display the svg properly, they couldn't even recognise it as an image.
Re: Protecting your email address via SVG instead of JavaScript
#130> Email addresses published on webpages usually need to be protected from email-harvesting spambots. Do they though? I have had my email address published on my website in a I use both Gmail and (for some other addresses) a webmail hosted by a local company which uses some other filter. Both work well, so it's not something only Google can do.
They do. My wife lost her 10-year-old Instagram account to a well crafted phishing attack against an email she had published… Instagram/Meta’s customer support is absolutely atrocious and disgraceful on this front. They basically treat my wife like she’s also a spammer and there’s no way to recover the account or undo any of the changes the spammers made. It’s hilarious how they ask you to “appeal” a ban by clicking…
Does her email show up on any leaks on https://haveibeenpwned.com/ ? I'm wondering if not publishing it would have made any difference to receiving phishing messages.