Can spammers scrape emails out of vcards posted on the web?

June 24, 2009 5:55 AM

Can spammers scrape emails out of vcards posted on the web?

It's pretty much common knowledge that it's a bad idea to post your email in plaintext unless you like getting a lot of spam. I've been asked to post vCards instead, but it seems to be that .vcf files are just text files and would be pretty trivial for bots to read. Does anyone know if the email harvesters have been going after vCards, or is it reasonably safe?

posted by Karmakaze to Computers & Internet (6 answers total)

They may just be too lazy. I have my email on the mit pgp server, academic publications, and various lists of participants in meetings and listhosts, and I still don't get much spam. Googling my exact address pulls up plenty of plain text. Even my throwaway address that I use to sign up for things that I think will spam me doesn't get much beyond the sites I signed up for.

Spam takes up .1 minutes of my average day. It's not worth worrying about.
posted by a robot made out of meat at 6:16 AM on June 24, 2009

Spammers could certainly extract your address from a VCard. The only obstacle is that they need to write (or find) a script that could parse e-mail addresses from that format. While that's trivial to do, it's an extra step and so most probably find the benefit isn't worth the effort involved.
posted by tomwheeler at 6:56 AM on June 24, 2009

Yes.
posted by Nelson at 8:27 AM on June 24, 2009

Theoretically, it's possible, of course.

In my experience in e-commerce and contact setup for sales divisions and IT work; in reality, it hasn't been a common occurrence. YMMV.
posted by ShawnStruck at 8:38 AM on June 24, 2009

Spammers could certainly extract your address from a VCard. The only obstacle is that they need to write (or find) a script that could parse e-mail addresses from that format. While that's trivial to do, it's an extra step and so most probably find the benefit isn't worth the effort involved.

Actually, getting the address from a vCard is easier than digging it out of a web page, since it's helpfully attached to a line beginning with "EMAIL". Reading vCards is a trivial problem, since it's a well-documented standard and parsers exist for any significant programming language.
posted by mkultra at 9:31 AM on June 24, 2009

If it's not already happening, it's only because spammers haven't yet considered it worth an easy morning's job. I wouldn't consider it in any way safe.
posted by Zed at 10:47 AM on June 24, 2009