Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Protecting your email address via SVG instead of JavaScript

rouninmedia.github.io

Post reply on HN
Print view View original

171–180 of 180 posts

Re: Protecting your email address via SVG instead of JavaScript

#171

Post by doug-moen »

digging wrote: post #118
yreg wrote: post #62

> Email addresses published on webpages usually need to be protected from email-harvesting spambots. Do they though? I have had my email address published on my website in a I use both Gmail and (for some other addresses) a webmail hosted by a local company which uses some other filter. Both work well, so it's not something only Google can do.

My preference is to not have my email harvested at all when possible, even if I don't personally see the spam emails. (I'm not saying it's a critical privacy/security issue, but a preference.)

My experience is that you send email to someone whose Op Sec is not as good as your own, then your email will be harvested at the point when that person's address book is harvested. I don't know all the details of how these harvests occur, but using a shady mobile app with Contacts permission would be enough.

Re: Protecting your email address via SVG instead of JavaScript

#173

Post by jakubmazanec »

digging wrote: post #153
jakubmazanec wrote: post #134

Earlier quoted context omitted.

So then you never use your email, right?

What?

Your email address cannot be (and isn't) secret, if you give it to other people (regular people, i.e. friends, colleagues, etc.) so they can send you emails. If you don't want your email harvested, you can never use it (at least to receive emails).

Re: Protecting your email address via SVG instead of JavaScript

#174

Post by speckx »

throwaway598 wrote: post #78

My domain: 24 years registered to me. A .com. My email address: Listed at the top of the front page. In a H3 tag. This email address's spam problem: Not a problem. 15ish per day get to me including Junk folder. Thanks Purelymail. What is a problem: Transactional email unrelated to transactions, Promotional email which is newsletter junk spam, Social networks complaining of not being used.

I have a few old domains I registered in the late 90s, and some of them still have the mailto with my email, some I rarely get any spam, and others it's dozens a day. SpamAssassin does a great job of caching the spam.

Re: Protecting your email address via SVG instead of JavaScript

#176

Post by michaelcampbell »

yreg wrote: post #62

> Email addresses published on webpages usually need to be protected from email-harvesting spambots. Do they though? I have had my email address published on my website in a I use both Gmail and (for some other addresses) a webmail hosted by a local company which uses some other filter. Both work well, so it's not something only Google can do.

Indeed; this is preference more than a problem to be solved, and this is not the solution.

An almost tin-foil hat wearing colleague of mine went on loudly and proudly about how he'd never give HIS phone number to Google, oh no! Not him!

I just had to say, "John, they have it - you're in my contact list."

He hadn't even considered that.

Re: Protecting your email address via SVG instead of JavaScript

#177

Post by miki123211 »

47282847 wrote: post #54
miki123211 wrote: post #53

While there's nothing stopping this technique from being accessible in principle, the example given in the article is a really bad one. The article uses "Email us!" as the label on the svg and a elements, which effectively hides the actual email address from screen readers. Using aria labels in this way is a really bad practice, a screen reader user should have the same experience as anybody else unless there's a ver…

Isn’t the whole point of the exercise to not have the document contain the email address in a (machine-)readable format?

Being accessible and behind machine-unreadable are literal opposites. A screen reader is not that different from an ad blocker or web scraper in how it accesses content.

There's a reason that many end-to-end testing experts recommend writing selectors based on accessibility labels instead of CSS classes or IDs, especially if you're using a library like Styled Components.

Re: Protecting your email address via SVG instead of JavaScript

#178

Post by barkbyte »

muzster wrote: post #70

Heavily guarded fortress would indicate something of value inside, and the big crooks may spend a little more effort. In the age of AI, this becomes even easier. { "model" : "gpt-4-turbo", "messages" : [ { "role" : "system", "content" : [ { "type" : "text", "text" : "return a json array of all valid emails found in the image." } ] }, { "role" : "user", "content" : [ { "type" : "image_url", "image_url" : { "url" : "da…

In no world is anyone wasting resources to run an AI model to parse a page that may or may not include an email address. Even running a DOM parser is more than they’d typically do. This is silly.

Re: Protecting your email address via SVG instead of JavaScript

#179

Post by ibcj »

WirelessGigabit wrote: post #155
xyst wrote: post #76

Earlier quoted context omitted.

this used to be a problem in the early 00s. I don’t think spam filtering was as good back then so protecting your public email from spam was necessary. Also this was a time when mail boxes were often allocated 10-25 megabytes. So spam bots could easily flood your email.

When I signed up for Hotmail it was 2MB. Then on April 1st, 2004 Google launched wasn't an April 1st joke... GMail with 1GB! I remember getting a beta invite and inviting others.

I had to buy my invite then, like a sucker. Apparently, I didn't make the cut of my friends who got legit invites to pass around.

Re: Protecting your email address via SVG instead of JavaScript

#180

Post by steve_rambo »

RaoulP wrote: post #36
ale42 wrote: post #27

Earlier quoted context omitted.

If you self-host your email, you can use "." as a delimiter instead of the "+". People would already need to know they can strip that part...

Sounds good! I might go even further and just use a custom address for each service, i.e. paypal@example.com or something. But self-hosting email is an adventure I'm nervous to embark on.

Don't, there are many smaller email providers that will take that load off your shoulders for a small fee. I've been using purelymail and have had good experience with it, and heard good things about migadu and fastmail. The latter two are more well known and better staffed, but also expensive.

I've been using similar aliases for years (paypal@domain.tld, ebay@domain.tld, etc), but make sure you have a contingency plan for when you're no more. I've received lots of account info from previous owners of the domain by setting up a catchall mailbox. We will obviously not care, but when someone takes over your account, they might use it to do harm to others (spam or fraud or whatever else).

Post reply on HN