Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Email obfuscation: What works in 2026?

spencermortensen.com

Post reply on HN
Print view View original

71–80 of 124 posts

Re: Email obfuscation: What works in 2026?

#71

Post by terrabitz »

Terr_ wrote: post #36
badsectoracula wrote: post #25

Some time ago i was wondering if the common "me at foobar dot com" you still see a lot of people do actually helps at all, especially now with LLMs, so i searched for some common "obfuscation" techniques and found this site (not the 2026 update, but the previous - it was a few months ago). Then i wrote a simple LLM query with a bunch of examples from the site[0] (the tool is just a frontend for a commandline program…

IMO a better approach would be individualized addresses. Imagine someone visiting your blog who wants to e-mail you can burn some CPU cycles to "earn" an address that hasn't been given out to anybody else, e.g. user+TOKEN@example.com, where it is algorithmically-unlikely for them to be able to guess a different TOKEN that will work. Then if abuse occurs, you can just retire that one address. (In a non-interactive con…

Sounds like a similar approach to this service: https://addy.io/

I use it all the time in conjunction with Bitwarden to generate unique emails per site. You can have notes in each email, and they show up in a small banner on in the forwarded email. And each one is individually disable-able, so you can easily cut it off if you see spam from it.

I was really interested in this space and made my own homegrown tool for this. I used it for a while until I discovered Addy and switched over. IIRC there are similar services by Mozilla, Apple, and Proton.

Re: Email obfuscation: What works in 2026?

#73

Post by SV_BubbleTime »

BorisMelnik wrote: post #65
GeoSys wrote: post #43

Earlier quoted context omitted.

I agree that email addresses get leaked eventually. However, LLMs are quite good at generating spam and I think soon will evade most filters.

you know what's funny is that llms are also good at detecting spam as they are generating it. I've got an automation that scores incoming emails and it's getting better and better each day (also more expensive haha)

I can’t explain it well, but I think there is an asymmetric issue here… that the ability for an LLM to write a plausible email, and the ability for an LLM to detect that it’s spam are mismatched.

If an LLM and make a plausible email, the best another LLM can do is to rank it as plausible. Blackbox creation and detection have to be on the same level.

Perhaps if you said the detection LLM had all your context and websearch. That it could know that a Penny Pollytree at Coco Co isn’t a real person, but… that just seems like burning a ton of coal to detect fraud where the creation LLM was able to easily come up with the fictitious spam cheaply.

The real story here is this will go beyond email verification. That every system we have is going to need to up its security. Paper birth certificates and social security cards and email addresses and all manner of identity is going to need new systems of auth. The challenge will be to prevent authoritarian centralization.

Re: Email obfuscation: What works in 2026?

#76

Post by [deleted] »

jrmg wrote: post #70
ciroduran wrote: post #10

I stopped being concerned about email harvesting years ago, I just simply leave the email on my website. Spam handling is okay enough, I guess. But I like this review of techniques, even the simplest ones are very effective, that surprised me.

I’ve had my email address in a `mailto:` link in plaintext on my then-web-site, now-blog, since the early 2000s, and spam is no real problem. There are a few spam messages in my spam mailbox per day. Perhaps my provider’s just great at filtering spam - but I kind of doubt it’s better than the major players (for years I’ve used Zoho for email - and it’s ‘okay’ enough that it’s not worth switching).

[deleted]

Re: Email obfuscation: What works in 2026?

#80

Post by [deleted] »

Bender wrote: post #45

They left off html cgi form. Generate the email on the web page and the server sends the email after performing some basic sanity checks and anti-spam on the form and web server itself such as solving some CSS puzzle or winning a game of DOOM.

[deleted]
Post reply on HN