Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Email obfuscation: What works in 2026?

spencermortensen.com

Post reply on HN
Print view View original

51–60 of 124 posts

Re: Email obfuscation: What works in 2026?

#51

Post by ghywertelling »

0x3f wrote: post #14
ghywertelling wrote: post #12

Earlier quoted context omitted.

https://www.gregegan.net/ Contact details: [any mailbox] [at] [the domain name of this web site]. Please don’t ask me to give interviews, sign books, appear on podcasts, attend conferences or conventions, or provide feedback or endorsements for works of fiction, scientific theories, or slabs of text disgorged by chatbots. I have no idea how to decipher this obfuscation.

What's difficult about it? You know the domain, gregegan.net. You know the @ symbol, presumably. Then put literally any valid text before the @.

Is that even possible? Shouldn't the recipient email id need to be created first to be addressable?

Re: Email obfuscation: What works in 2026?

#52

Post by embedding-shape »

Gigachad wrote: post #49
GeoSys wrote: post #43

Earlier quoted context omitted.

I agree that email addresses get leaked eventually. However, LLMs are quite good at generating spam and I think soon will evade most filters.

I doubt it. Most of the signals spam filters use these days are reputation based. You have to build up your domain and IP reputation for a long time first.

> You have to build up your domain and IP reputation for a long time first.

Or buy/rent domains/IPs that have good reputations, as there are services that specializes in just bringing up the reputation for stuff so they can sell it once "good". Same exists for user accounts for various platforms like reddit and so on.

Re: Email obfuscation: What works in 2026?

#54

Post by hrmtst93837 »

jwr wrote: post #13

This is such a waste of effort. Your E-mail address is not and can't be a secret. It will get into spammer databases eventually, no matter what you do. You will spend a lot of effort doing all these fancy tricks, and eventually you will get spam anyway. Also, a note to those who make fancy "me+someservice@somedomain.com" addresses: make really sure you are in control and these work. Some services (including mine) wil…

[flagged]

Re: Email obfuscation: What works in 2026?

#55

Post by kqr »

I have a hypothesis email scrapers don't parse HTML at all. I suspect they search the raw bytestring for @ characters and take whatever's on either side of it. That probably gets them as many addresses as they can realistically use at a fraction of the cost, given how expensive HTML parsing can be.

(Similarly, I'm sure most links can be found by searching the bytestring for "href" and taking what's to the right of it.)

This would explain why HTML entities are so effective.

On the other hand, surely the TLS handshake is far more expensive than HTML parsing? Maybe it's to avoid parser failure modes that consume a lot of resources?

Re: Email obfuscation: What works in 2026?

#56

Post by cyberlimerence »

ghywertelling wrote: post #51
0x3f wrote: post #14

Earlier quoted context omitted.

What's difficult about it? You know the domain, gregegan.net. You know the @ symbol, presumably. Then put literally any valid text before the @.

Is that even possible? Shouldn't the recipient email id need to be created first to be addressable?

Of course, the technical term for that setup is 'catch all', you can set this up with your email provider. You can send your email to "ghywertelling@gregegan.net", for example.

Re: Email obfuscation: What works in 2026?

#57

Post by Gigachad »

embedding-shape wrote: post #52
Gigachad wrote: post #49

Earlier quoted context omitted.

I doubt it. Most of the signals spam filters use these days are reputation based. You have to build up your domain and IP reputation for a long time first.

> You have to build up your domain and IP reputation for a long time first. Or buy/rent domains/IPs that have good reputations, as there are services that specializes in just bringing up the reputation for stuff so they can sell it once "good". Same exists for user accounts for various platforms like reddit and so on.

Sure, you'd burn that reputation extremely fast as Google detects your sending patterns change and the first few users start reporting as spam.

Re: Email obfuscation: What works in 2026?

#58

Post by robotswantdata »

yummypaint wrote: post #35
robotswantdata wrote: post #34

Earlier quoted context omitted.

How does that work if the scraper takes a screenshot to feed to a LLM or OCR?

That seems like a very expensive way to crawl the internet

Scrape normally collect emails, if no email seen take screenshot and OCR OCR is cheap and REGEX is cheap

Re: Email obfuscation: What works in 2026?

#60

Post by j45 »

kqr wrote: post #55

I have a hypothesis email scrapers don't parse HTML at all. I suspect they search the raw bytestring for @ characters and take whatever's on either side of it. That probably gets them as many addresses as they can realistically use at a fraction of the cost, given how expensive HTML parsing can be. (Similarly, I'm sure most links can be found by searching the bytestring for "href" and taking what's to the right of it…

Token based extraction around the @ is definitely one way that can work with a few tweaks.
Post reply on HN