Does email address obfuscation actually work?
superuser.com
superuser.com
It probably cuts down on spam, but I'm sure it also counts down on legitimate inquiries that didn't get made because the person who wanted to contact them said "fuck it" rather than typing the e-mail by hand. (You could argue that lack of e-mail from those people isn't a great loss, but whatever.)
Isn't spam detection at this point good enough that this isn't a concern anymore? gmail has let precisely three bits of spam slip through in the past two months.
Sure, I could use epochwolf's suggestion with filters, but filters are for granular sorting and personal preferences: adding labels, skipping inbox, forwarding, etc. that would be pretty much impossible to guess for a "machine". As far as I'm concerned, clicking "Not Spam" should be very similar to creating a filter that says "every email that look like this (same address, same kind of content, etc.), do NOT mark it as spam". If this is not what's happening, these buttons are just useless.
I do want google to take all of the data they keep on my searches and all the little scribbled notes their furtive servers make on my whereabouts as I stroll around the web and put it to use to make my experience better.
Did google show me an ad at http://troutpeeler.com? [1] Did an email come to me from do_not_reply@troutpeeler.com 5 minutes later about an order from me? That isn't spam! And now they know I'm interested in at least one sort of fish peeler. Take that into consideration when a commercial mail for fried fish skin enthusiasts shows up at my inbox.
[1] This is meant to be a fictitious instance of a web site and a product. Heaven knows I'm rubbish at making up unused names, so there probably is a Trout Peeler website somewhere and a group of peel that make fried fish skins. I don't want to hear about it. Ick.
[2] I wonder how many people with browser extensions have to click on http://troutpeeler.com to trick a name squatting robot into reserving the name.
Also, not everyone has a Gmail account. I'm sure virtually everyone on HN does, but some of us also wind up making websites for people who are less savvy. So techniques for obfuscation could still be useful.
True, but I thought spam detection was something that was 99% effective with bayesian filters. Sure, not all of your clients will have them, but I figure that people who are truly worried about this sort of thing will either be running their own mail servers, or will pay someone to do it for them.
So, either the gmail engineers are better than most, or it is still not trivial to get it right.
The other benefit to gmail is shared inoculation. By the time you get to your mailbox, a thousand others may have reported it as spam, and it is already marked as spam on your inbox. With a small, personal mailbox, or even a companywide deployment, you may not get enough benefit from shared inoculation.
FWIW I do train my SA installation (actually amavisd-new) with sa-learn.
> The other benefit to gmail is shared inoculation.
A very good point. My mail server has very, very few users.
On the other hand, I am using DNSBLs, Razor, and Pyzor through SA, so you might think I'd benefit more from that. (Which is not to say SA isn't blocking a ton of spam--it's just not doing as good as Google: one every six weeks or something from Gmail, a handful every day from SA.)
I run greylisting -> dspam (toe) -> tmda for anything dspam flags and have had 1 missed spam this week. Looking through the tmda queue, I see no false positives. I have had false positives in the past, but, once they reply (similar to spamarrest), it lets them through. I do run a few DNSBLs, but, really haven't see much need to increase it. I'd say 80% of the spam I used to receive was eliminated with greylisting. Probably 60% of it now as spammers are starting to hack actual servers that will retry rather than sending mail from botnets.
What I do is the following: SpamAssassin rules + Bayes (currently about 200k mails trained, 25% of them spam) + URIBL. I think I could even tune that with Razor and/or Pyzor but I get to few spam to actually care.
Since that, I've given up hiding my mail. On a long enough timescale, the probability that spammers get your email address is 1, so why bother?
As far as emails I receive, 99% are from people I've corresponded with and sometimes when I'm on the phone and they say, I just sent you my contact information, it is a little disconcerting the first time to have to wait 5-10 minutes.
I know spammers have my email address. I don't want to have to waste the time looking through the spam folder any more than I have to. The way it is now, I have a high probability that every email in my inbox is an actionable email, and I'm not stuck shuffling through a junk folder.
But, you do have a very good point regarding one of the downfalls from greylisting.
And if not... maybe someone should make one.
The obvious downside is that someone could poison the well. I don't know how to go about fixing that off the top of my head, but I've been drinking. :)
In theory an address harvester could easily work around such simple obfuscation, but in practice this seems to raise the bar just enough to make it not worthwhile for them. Email addresses I've posted in plaintext receive much more spam than the one I have obfuscated on my web page. (But greylisting plus SpamAssassin seems to take care of that spam quite well, so it's not as though the obfuscation itself is my only line of defense.)
He's had the same public email address published without obfuscation for more than 10 years. He describes his anti-spam setup which has served him reliably and argues that the nuisance imposed on correspondents by scrambling his address isn't worth it.
Any spambot that regexps \W or [a-z0-9\.] will get screwed up by the + that appears in the address. However, it's still a totally legal address, it delivers correctly, is clickable in browsers, etc.
It's not that I get a low level of spam at this public address - I get ZERO spam. Zero in the last 5 years. I get a small amount addressed to the plain me@gmail.com address, but it seems like spambots just don't pattern match for this. Anyway, it's still a gmail address, and their spam filtering might have something to do with this.
I probably get 30 or so pieces of spam per day, all of which ends up in my Junk folder with no effort on my part. This has remained constant over the years. I get a lot more random cr@p on my personal address ever since I was placed on a list of "people who will blog about your stuff." (which is emphatically not the case).
I also created a personal FAQ (http://www.jeff-barr.com/?page_id=670) to cut down on the amount of random stuff that I get.
Gmail does a great job of keeping spam out of my box, but I still have to go through the spam folder occasionally to look for false positives (I get a couple a year), so I'd prefer as little spam in there as possible.
As for obfuscating, I use methods which require the reader to think, not to apply a rule. All the obfuscation methods presented in the superuser answer can be algorithmically beaten. Mine can't. It requires understanding the words I used. That is, unless it gets copied enough times to be recognized as a standard pattern for obfuscation. But if that happens, I can just change it to something else that requires reading and understanding.
PS: My first Gmail account got spam before I started to use it.
* Spamgourmet for websites I don't trust. some_random_text.underwater@spamgourmet.com will forward six emails to my real address.
* A some_random_text@my-domain.com address with a catch-all for mail I really need.
* ReCAPTCHA's mailhide <http://www.google.com/recaptcha/mailhide/>; for posting my email on the crawlable web.
I have noticed that most spam I do get is not from online businesses, but from businesses I've given my email to in person (e.g. conventions, competitions).
Does anyone have spam problem with a published email address? Have you had success reducing spam by obfuscating it?
Sorry, but just to be sure - am I getting it right, those emails were false-positives?
Yup. For the most part, ones that I'm fine with - e.g. order confirmations from stores - but I've found the odd one in there from someone the first time they email me, most frustrating.
On the other hand, I once nearly missed out on a fun blind date after my initial email was helpfully filtered by Hotmail into the girl-in-question's spam folder. And it didn't even mention Viagra!
Also, as you receive a lot of spam, the distribution is highly skewed towards spam, so it is unlikely you find a false positive because there are a lot more true positive, not because the false positives are absent.
So there is a chance you are getting false positives, but have failed to spot them (I know it happens to me).
How?
http://techblog.tilllate.com/2008/07/20/ten-methods-to-obfus...
Different approaches to obfuscating the email address and comparing spam levels.
- You can't copy them
- You can't type them
- You can't embed them in text
(Though, the latter two problems apply to some of the methods discussed here as well)
If they did catch on widely, it would be trivial for email address harvesters to read them (see: increasingly-complex captchas)
I do agree that eventually email address harvesters could eventually be made to read them though, and that would be a big weak point if they ever did catch on.
But don't use inline styling. Bury the rules in the cascade with some parent class so they can't be easily filtered.
Remarkably little spam gets through to me. I actually see more spam in my non-public gmail account where, I suspect, the spammers are simply name guessing.
Long story made not much shorter -- I would guess that scraping isn't that big of a strategy any more.
Spammers literally sit around all day figuring out ways to deliver more spam, I'm fairly certain they've spent the 30 minutes it takes to craft a regular expression to harvest the easy 80% of these 'obfuscated' e-mails.
The distribution of the probability that users click an ad is highly skewed. I suspect that it has probabilities close to zero for people who use "these 'obfuscated' e-mails".
If that is the case, spamming those users does not make economical sense.
So is scraping - a means to sell big lists of e-mail addresses to people who buy them for many thousands of dollars, with little regard to where they came from - only that they receive e-mail.
And yet I see seasoned programmers who should ostensibly know a little about regex using this kind of obfuscation all the time!
So long as you're in the other 20%, you'll probably do well.