Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Protecting your email address via SVG instead of JavaScript

rouninmedia.github.io

Post reply on HN
Print view View original

131–140 of 180 posts

Re: Protecting your email address via SVG instead of JavaScript

#131

Post by dgb23 »

a_random_canuck wrote: post #127
yreg wrote: post #62

> Email addresses published on webpages usually need to be protected from email-harvesting spambots. Do they though? I have had my email address published on my website in a I use both Gmail and (for some other addresses) a webmail hosted by a local company which uses some other filter. Both work well, so it's not something only Google can do.

They do. My wife lost her 10-year-old Instagram account to a well crafted phishing attack against an email she had published… Instagram/Meta’s customer support is absolutely atrocious and disgraceful on this front. They basically treat my wife like she’s also a spammer and there’s no way to recover the account or undo any of the changes the spammers made. It’s hilarious how they ask you to “appeal” a ban by clicking…

This could happen to anyone. You’re tired or thinking of something else, the attack weirdly aligns and you don’t notice it until it’s too late.

Re: Protecting your email address via SVG instead of JavaScript

#132

Post by _blk »

Seems like a great solution but I'd like to embed the data directly rather than linking an external file. Then one issue I see is that dumb scrapers just look for the email address (also in the embedded SVG, which they might not for external or files.) But for direct embeds, if the string is not otherwise encoded, that could potentially leak the email address.

While this obviously (re)introduces JS into the mix, how would a simple compressed string fare against base64 svg embedding?

``` const compressedBase64Svg = '...';

function decompressAndInsertSVG(encodedData) { const decodedData = atob(compressedBase64Svg); const decompressedSvg = decompress(decodedData); const svgContainer = document.getElementById('svgContainer'); svgContainer.innerHTML = decompressedSvg; }

decompressAndInsertSVG(encodedSVG); ```

Re: Protecting your email address via SVG instead of JavaScript

#133

Post by chefandy »

a_random_canuck wrote: post #127
yreg wrote: post #62

> Email addresses published on webpages usually need to be protected from email-harvesting spambots. Do they though? I have had my email address published on my website in a I use both Gmail and (for some other addresses) a webmail hosted by a local company which uses some other filter. Both work well, so it's not something only Google can do.

They do. My wife lost her 10-year-old Instagram account to a well crafted phishing attack against an email she had published… Instagram/Meta’s customer support is absolutely atrocious and disgraceful on this front. They basically treat my wife like she’s also a spammer and there’s no way to recover the account or undo any of the changes the spammers made. It’s hilarious how they ask you to “appeal” a ban by clicking…

Would such an attacker be stymied by this? It seems like automated email harvesting wouldn't be a big time saver for any attack that required a well-crafted anything. I don't know anything about that particular attack, though.

Re: Protecting your email address via SVG instead of JavaScript

#134

Post by jakubmazanec »

digging wrote: post #118
yreg wrote: post #62

> Email addresses published on webpages usually need to be protected from email-harvesting spambots. Do they though? I have had my email address published on my website in a I use both Gmail and (for some other addresses) a webmail hosted by a local company which uses some other filter. Both work well, so it's not something only Google can do.

My preference is to not have my email harvested at all when possible, even if I don't personally see the spam emails. (I'm not saying it's a critical privacy/security issue, but a preference.)

So then you never use your email, right?

Re: Protecting your email address via SVG instead of JavaScript

#135

Post by samatman »

RaoulP wrote: post #36
ale42 wrote: post #27

Earlier quoted context omitted.

If you self-host your email, you can use "." as a delimiter instead of the "+". People would already need to know they can strip that part...

Sounds good! I might go even further and just use a custom address for each service, i.e. paypal@example.com or something. But self-hosting email is an adventure I'm nervous to embark on.

Anecdotally, sending mail to example.com from example@mydomain.com can cause a whole host of human-factors problems which can be eliminated with something like RaoulPtoExample@mydomain.com.

Re: Protecting your email address via SVG instead of JavaScript

#137

Post by pdonis »

nojs wrote: post #136

This is a cool trick. The email is in cleartext in the source, meaning mailto works and copy-paste works. But most scrapers probably skip the .svg file.

> most scrapers probably skip the .svg file

But they won't as soon as they realize it's just easy to parse text that contains data they're looking for.

Re: Protecting your email address via SVG instead of JavaScript

#138

Post by yau8edq12i »

magnat wrote: post #9

> even when a human visitor has their JavaScript turned off, the email address displayed on the page remains usable NoScript on Firefox with default settings don't render tags (replaces them with placeholders), so this technique doesn't work here. https://imgur.com/2tCAgAf

That's a different thing, though. Not sure why you'd make this point.

Re: Protecting your email address via SVG instead of JavaScript

#139

Post by qingcharles »

yreg wrote: post #62

> Email addresses published on webpages usually need to be protected from email-harvesting spambots. Do they though? I have had my email address published on my website in a I use both Gmail and (for some other addresses) a webmail hosted by a local company which uses some other filter. Both work well, so it's not something only Google can do.

I have two people I designed web sites for in the last year and I put both their email addresses in the footer and neither one of their accounts has received a single spam message in all of that time (not even something dropped into the Spam folder). Both sites are popular and have thousands of visitors and get scraped by every search engine and AI bot you can think of.

Re: Protecting your email address via SVG instead of JavaScript

#140

Post by qingcharles »

a_random_canuck wrote: post #127
yreg wrote: post #62

> Email addresses published on webpages usually need to be protected from email-harvesting spambots. Do they though? I have had my email address published on my website in a I use both Gmail and (for some other addresses) a webmail hosted by a local company which uses some other filter. Both work well, so it's not something only Google can do.

They do. My wife lost her 10-year-old Instagram account to a well crafted phishing attack against an email she had published… Instagram/Meta’s customer support is absolutely atrocious and disgraceful on this front. They basically treat my wife like she’s also a spammer and there’s no way to recover the account or undo any of the changes the spammers made. It’s hilarious how they ask you to “appeal” a ban by clicking…

Clicking the appeal button is like a trap to permanently ban your account.

You can get it back by paying off a Meta employee through a site like Swapd. It's either that or get your comment to the front page of HN. Those are the only two customer support channels for Meta or Google.

Post reply on HN