Seems kind of easy to defeat, just read the SVG to extract the email address from the mail to: link contained therein. Bonus the harvesting bots will now download all SVG files going forward.
Protecting your email address via SVG instead of JavaScript
141–150 of 180 posts
Re: Protecting your email address via SVG instead of JavaScript
#142> Email addresses published on webpages usually need to be protected from email-harvesting spambots. Do they though? I have had my email address published on my website in a I use both Gmail and (for some other addresses) a webmail hosted by a local company which uses some other filter. Both work well, so it's not something only Google can do.
The practice of email address "obfuscation" feels like a relic of a bygone era, one that was never actually sound in its methodology, but spread. A form of cargo-cultism has kept it alive
Re: Protecting your email address via SVG instead of JavaScript
#143google might start indexing your email
Re: Protecting your email address via SVG instead of JavaScript
#144At that point, isn't adding a good old contact form a simpler solution? You can link it with your email address or other channels. It can even works with static websites, I hooked up mine with Nextcloud Forms.
I appreciate the hacker creativity at display here, but as other said obfuscating an email address raises accessibility issues. Hiding content from some programs and not others (spam bots vs assistive technologies) seems inherently a losing game, for you or for users.
Re: Protecting your email address via SVG instead of JavaScript
#145> Email addresses published on webpages usually need to be protected from email-harvesting spambots. Do they though? I have had my email address published on my website in a I use both Gmail and (for some other addresses) a webmail hosted by a local company which uses some other filter. Both work well, so it's not something only Google can do.
Exactly.
I definitely recall in the early 2000's it absolutely did lead to spam, and e-mail obfuscation techniques were a real thing that genuinely helped.
But by 2015 or so it didn't matter at all anymore, in my personal experience. It didn't even lead to spam that needed to filtered. Spammers just stopped looking for e-mails that way.
Which makes perfect sense -- most people don't have their e-mail address listed anywhere online in the first place, but you can purchase gigantic lists of e-mail addresses. That either originate from companies that sell their own user lists, or people who hacked the companies' servers.
These days if you want to send spam, trawling the web for e-mails makes zero sense. It's practically the least efficient thing you could do.
Re: Protecting your email address via SVG instead of JavaScript
#146I think the main thing people forget with stuff like this is that yes, all these setups are possible (or even trivial) to bypass, but you're not really dealing with a dedicated adversary that's targeting you in particular. Spammers probably aren't going to update their tools to take into account every possible way every site obfuscates their email addresses, so the main trick to dealing with them would be to do somet…
> Spammers probably aren't going to update their tools to take into account every possible way every site obfuscates their email addresses
But this is also sort of a security through obscurity approach, if enough people adopt one of these methods of obfuscation then the spammers absolutely will change their tools.
Re: Protecting your email address via SVG instead of JavaScript
#147> Email addresses published on webpages usually need to be protected from email-harvesting spambots. Do they though? I have had my email address published on my website in a I use both Gmail and (for some other addresses) a webmail hosted by a local company which uses some other filter. Both work well, so it's not something only Google can do.
very recently, within a day of publishing an email on a footer of a page i got a phishing email that was not filtered by spam and looked very genuine
Re: Protecting your email address via SVG instead of JavaScript
#148My domain: 24 years registered to me. A .com. My email address: Listed at the top of the front page. In a H3 tag. This email address's spam problem: Not a problem. 15ish per day get to me including Junk folder. Thanks Purelymail. What is a problem: Transactional email unrelated to transactions, Promotional email which is newsletter junk spam, Social networks complaining of not being used.
> Social networks complaining of not being used
This is my biggest one. I get more spam from Facebook begging me to log in than I do from almost anything else. I haven't used the account in about 7 years, you'd think they'd figure it out.
Re: Protecting your email address via SVG instead of JavaScript
#149I gave up on this sort of thing. Spam filters are good enough nowadays that I don't think I see an increase in spam by having my email address publicly available without obfuscation. (That is, an increase beyond other spam sources, like crappy companies who have my email address for a legitimate purpose, but sell it to third parties.) In general I see less than 1 spam email hit my inbox per day, and that's fine.
Granted, this may depend on email provider and spam filter, so YMMV, but it hasn't been an issue for me.
Re: Protecting your email address via SVG instead of JavaScript
#150> Email addresses published on webpages usually need to be protected from email-harvesting spambots. Do they though? I have had my email address published on my website in a I use both Gmail and (for some other addresses) a webmail hosted by a local company which uses some other filter. Both work well, so it's not something only Google can do.
The practice of email address "obfuscation" feels like a relic of a bygone era, one that was never actually sound in its methodology, but spread. A form of cargo-cultism has kept it alive
Yeah just looking at this, it appears to add about 1K of overhead and at least one additional http request for something that ultimately boils down to a mailto: link, so it can still be scraped, and just adds bloat to your web page.