How to spam-protect a web-published e-mail address?

June 4, 2006 11:57 AM

I need to post an e-mail address to the contact page of a website. What's the safest way to do this? (Is there a safe way?)

In the past I've used the Hivelogic email enkoder. Can anyone vouch for the efficacy of this method? I've considered using the enkoder with an additional layer of misdirection: for example, creating a dummy [e-mail] address which, if it became a spam target, would be changed to [e-mail], etc.

What about posting the address as an image? Is this effective?

I need to get my contact information up, but I'm pretty darn wary about doing so...

posted by jdroth to computers & internet (18 comments total)

I'd avoid using any standard solution like the one in your link. It's not strong encryption and if there are enough adopters to make the clientele attractive to spammers they'll break it and spider for it. A home-rolled solution like an image (with no mailto: link or compromising alt text) would have to be typed into a spam database manually, and it's really never going to get any more difficult than that. (That is, unless spammers are doing mass-OCR, but I think that's unlikely considering the volume of easier pickings)
posted by moift at 12:20 PM on June 4, 2006

What about a form where people can submit a message that gets emailed to you?
posted by agropyron at 12:35 PM on June 4, 2006

I put my e-mail address ([e-mail]) online freely, and I have done so since before anyone had heard of spam. If you want people to be able to contact you easily, you pay a price.

But with good spam detection software, like the free spambayes, spam is a very managable annoyance. Last month, I got 10368 messages, including 6875 spam, about 300 addressed directly to me, and the rest on various mailing lists. Of those, about 60 (<1 %) had to be manually classified as spam or not.br>
You may worry "what if I miss a message because it was caught as spam", but if you use a system that inconveniences your correspondent (e.g., forcing her to manually tanscribe an address that is shown as an image) you will also deter people from communicating with you. "enkoder" is such a scheme, because it only works for people who enable javascript in their web browser.
posted by jepler at 12:37 PM on June 4, 2006

If you make it slightly nonstandard, it'll fool anything automated. That's the best you can hope for. Personally, find email addresses that are the actual hyperlink (email:blah) with [e-mail], since you can click that and take it out in your email client fairly easily.
posted by devilsbrigade at 12:41 PM on June 4, 2006

Why not just sign up for a throwaway Hotmail address and use that?
posted by gfrobe at 12:42 PM on June 4, 2006

Sorry, just realized I misread your question. Disregard my suggestion..
posted by gfrobe at 12:44 PM on June 4, 2006

@ jepler
You have an excellent point. I use spamsieve on a Mac and it's excellent. It does take time to sort through the spam every day, though, and I'd hate to have to spend more time at. Still, I may consider just giving in.

@agropyron
This morning I set up a separate page with a comments section -- comments will forward to me. I was hoping to add an actual e-mail address, too, though.

@devilsbrigade
Yours may be the best solution. We'll see...
posted by jdroth at 1:08 PM on June 4, 2006

I like using onMouseOver/onClick handlers to change the link's URL to a programmatically-determined (not hardcoded) e-mail address just before the user clicks on it. A spammer would have to be running a crawler that not only runs JavaScript to render the page, but which also simulates the JavaScript click event hierarchy on every link on the page.

<a href="mailto:[e-mail]" onMouseOver='myrealaddr="sendtome"' onClick='url=this.href.split("@"); url[0]=myrealaddr; url[0]="mailto:"+url[0]; this.href=url.join("@")'>send me mail</a>

How this works:

1) the href goes to an invalid email address at the same domain. In my example I use [e-mail]. I actually want this address on spammers' lists because it helps my mail server identify spam.

2) onMouseOver sets the variable myrealaddr to my real address (at the domain) when the user mouses over the e-mail link.

3) onClick changes the target of the link using the value of the variable when the user clicks the link.

For bonus points, URL-encode the myrealaddr assignment:

<a href="mailto:[e-mail]" onMouseOver='myrealaddr=unescape("%73%65%6e%64%74%6f%6d%65")' onClick='url=this.href.split("@"); url[0]=myrealaddr; url[0]="mailto:"+url[0]; this.href=url.join("@")'>send me mail</a>

For bonus bonus points, entity-encode all the tag attributes of the above. I won't post the result here because it'll ruin the layout of this page. I've posted it on my server.

There are other tricks I like but that's one of the simplest and most effective, IMHO.
posted by kindall at 1:54 PM on June 4, 2006

Here's my unobtrusive JavaScript solution that gives a clickable E-mail address. Unlike other JavaScript encoding techniques, it is still accessible for people that don't have JavaScript enabled.
http://pastebin.com/758420
posted by Sharcho at 2:08 PM on June 4, 2006 [1 favorite]

Simply replace the @ with an &#064; -- spammers have never harvested such addresses, as demonstrated by the Center for Democracy & Technology in their awesome March 2003 study.

Why? Because the sort of person who disguises their e-mail address is the kind of person that is going to report spam to Spamcop and the like, and decidedly not the kind of person who would ever buy anything from spam.
posted by waldo at 2:38 PM on June 4, 2006

Sharcho wins for best solution! Very graceful.

I wonder how many spam spider's are capabile of executing Javascript though.

I took sharcho's code and will be using it on my site. I am going to change it a little so the fallback e-mail address is actually a link to a HTML form contact page.
posted by schwa at 2:45 PM on June 4, 2006

You might want to take the 'nospam' idea and riff on it, if you're worried about crawlers being able to decode the script.

My own page displays something along the lines of "E-mail me at [e-mail], removing the fish from the address first." And then everytime the page loads, a simple Javascript routine chooses from haddock, perch, trout, salmon, cod and about 12 other creatures. The logic is that automated e-mail crawlers aren't clever enough to figure out what part of the address is the interloping aquatic lifeform.

You could also do something like [e-mail]!.spam.GAH!.com but you might think that's silly.
posted by randomination at 3:15 PM on June 4, 2006

What about a form where people can submit a message that gets emailed to you?

Those tend to get spammed just as much — although I suppose they don't get your email on mailing lists.
posted by smackfu at 3:40 PM on June 4, 2006

Posted on my site I use name [at] domain [dot] com in the email link, and when I post it elsewhere (as in comments), [e-mail]
posted by SenshiNeko at 3:51 PM on June 4, 2006

I wonder how many spam spider's are capabile of executing Javascript though.

A fair number. They just use the Internet Explorer built into Windows, typically. However, while these will get inline tags created with document.write, they won't catch things fired off by an event, as that would require that something simulate a click on each link on the page and run any attached JavaScripts.

Robots also generally don't follow form tags, which is another way to hide your e-mail address (have the form handler script send a redirect to a mailto: URL).
posted by kindall at 3:53 PM on June 4, 2006

Just to clarify that I didn't write the code mentioned above. I've managed to trace back where I originally found it. The original version.

There's also another version linked there that uses the same concept that kindall mentioned to prevent JavaScript-capable spiders.

I've never received any spam in a JavaScript encoded address, so I don't think it's an issue.
posted by Sharcho at 5:24 PM on June 4, 2006

Sharcho,

Still a lovely little script. I've modified it so that it works with:

foo [at] bar.com

Here's the modified code:

http://toxicsoftware.com/scripts/utilities.js
posted by schwa at 6:33 PM on June 4, 2006

Whichever disguise method you end up with, just use a Gmail address and let Google filter the spam for you. I've had the same mail address for years, about 70% of what gets sent to it is spam, and my POP3 client just doesn't see it.

The only spam I still get arrives via my (even older) Yahoo account.

I used to comb through my Gmail spam folder every now and again just to see if there was anything valuable in there. There never was, so these days I don't bother. As far as I can tell, Gmail's spam filtering Just Works.
posted by flabdablet at 4:15 AM on June 5, 2006