Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Email obfuscation: What works in 2026?

spencermortensen.com

Post reply on HN
Print view View original

91–100 of 124 posts

Re: Email obfuscation: What works in 2026?

#91

Post by Macha »

badsectoracula wrote: post #25

Some time ago i was wondering if the common "me at foobar dot com" you still see a lot of people do actually helps at all, especially now with LLMs, so i searched for some common "obfuscation" techniques and found this site (not the 2026 update, but the previous - it was a few months ago). Then i wrote a simple LLM query with a bunch of examples from the site[0] (the tool is just a frontend for a commandline program…

I would expect that a llm based scraper is going to be better at parsing an email address from your instructions than some of the more inattentive people who's emails you might want to receive. So I think some of the dumber mitigation measures that still block the simple regex bots from this topic are probably a better bet now.

Re: Email obfuscation: What works in 2026?

#92

Post by nzealand »

ProllyInfamous wrote: post #88

Really surprised this [very well-written] article didn't suggest the fantastic technique of owning an entire domain (although author's own examples obviously include unique handles@ for each tested practice). Then you can hand each recipient an absolutely unique email which isn't just ole "name.morewords@" period trick — block those which receive SPAM. ---- OR: the even "easier" lifestyle of just not using email (lik…

I've been doing that for two decades. Most of the spam comes directly to my primary gmail. Because I shared that with friends and family. And at least some of my friends and family shared their entire contact list with the wrong app at least once.

This article however is talking about publishing your email address on a public website. It matches my experience, that simple javascript concatenation stops 100% of spam. Not that I would or ever did trust my primary email address to that.

Re: Email obfuscation: What works in 2026?

#93

Post by blitzar »

Yaggo wrote: post #38
ciroduran wrote: post #10

I stopped being concerned about email harvesting years ago, I just simply leave the email on my website. Spam handling is okay enough, I guess. But I like this review of techniques, even the simplest ones are very effective, that surprised me.

Same here, the address will eventually leak some way anyway. I never got SpamAssassin working very well, but since moving my email hosting to Apple (from my own server), spam has not been a problem.

I swear my apple hosted mail spam filter works in reverse. The inbox is full of spam and the legitimate messages (including apple billing notifications) in the spam folder.

Re: Email obfuscation: What works in 2026?

#94

Post by lenwood »

dandersch wrote: post #8

Very interesting. It seems for his own email the author has opted for a combination of the CSS display none technique and a XOR cipher: 999a8f84898f98 aa 878b8386c4 999a8f84898f988785989e8f84998f84c4898587

I noticed that, too. Technically I think this is a version of JS conversion. Interesting that he doesn't specifically mention XOR in the article. He does suggest combining methods though. I suspect this is effective.

Re: Email obfuscation: What works in 2026?

#95

Post by kevincox »

ciroduran wrote: post #10

I stopped being concerned about email harvesting years ago, I just simply leave the email on my website. Spam handling is okay enough, I guess. But I like this review of techniques, even the simplest ones are very effective, that surprised me.

I've also been like this. But if as the article suggests trivial options like HTML entities or elements with display:none will keep my email out of >90% of harvesters I'm reconsidering as they seem to have no downside other than an extra couple of bytes on the wire.

Re: Email obfuscation: What works in 2026?

#96

Post by ProllyInfamous »

nzealand wrote: post #92
ProllyInfamous wrote: post #88

Really surprised this [very well-written] article didn't suggest the fantastic technique of owning an entire domain (although author's own examples obviously include unique handles@ for each tested practice). Then you can hand each recipient an absolutely unique email which isn't just ole "name.morewords@" period trick — block those which receive SPAM. ---- OR: the even "easier" lifestyle of just not using email (lik…

I've been doing that for two decades. Most of the spam comes directly to my primary gmail. Because I shared that with friends and family. And at least some of my friends and family shared their entire contact list with the wrong app at least once. This article however is talking about publishing your email address on a public website. It matches my experience, that simple javascript concatenation stops 100% of spam.…

This is your configuration error (likely just using a simple catch-all)?

When configured correctly each family member can reach you at a custom handle@, even seeing this custom reply address in response emails from you.

----

But yes, you're correct about the purpose of OP's article (website obfuscation). The topic-overlap is so close that it's still worth mentioning, IMHO.

Re: Email obfuscation: What works in 2026?

#97

Post by jonathanstrange »

I've never obfuscated my mail and do not use server-side spam filters, yet have never had a problem with spam. Yes, I get maybe twice or three times as much spam than legitimate mail (if we include spam that was once (semi-)authorized when clicking the wrong option). However, it's all filtered reliably client-side.

Re: Email obfuscation: What works in 2026?

#98

Post by jmaw »

unilynx wrote: post #82
ciroduran wrote: post #10

I stopped being concerned about email harvesting years ago, I just simply leave the email on my website. Spam handling is okay enough, I guess. But I like this review of techniques, even the simplest ones are very effective, that surprised me.

> But I like this review of techniques, even the simplest ones are very effective, that surprised me. because harvesters don't care until one technique gets massive use. if you come up with a unique but simple enough scheme for your sites and keep a few dozen email addresses out of their reach.. they've still gathered a million addresses. it's not really worth their effort to get the last 0.0001% of extra email addre…

The author of the article mentioned that they are using it as a honeypot to detect when bots (or rather authors of the bots) implement a work-around for the obfuscation technique. Which is pretty smart!
Post reply on HN