DTP


 
Lively discussions on the graphic arts and publishing — in print or on the web


Go Back   Desktop Publishing Forum > General Discussions > Web Site Building & Maintenance

Reply
 
Thread Tools Display Modes
Old 07-07-2006, 08:56 AM   #1
iamback
Member
 
iamback's Avatar
 
Join Date: Oct 2005
Location: Amsterdam, NL
Posts: 4,894
Default

Quote:
Originally Posted by ktinkel
You remind me: I have been using a JavaScript script to obfuscate addresses. Is that what you use (I have a hunch not!) — or what is a good way?
Never use JavaScript only for what is basic functionality. If you obfuscate with JavaScript then (with most, if not all, JS functions for that anyway) you'd end up with no way to contact by email for those who don't use JavaScript for whatever reason.

When I use an email address I usually obfuscate with a small PHP routine - dynamically; but actually by now I favor using a form (which doesn't reveal an email address in the first place); and it can be further protected against spammers in various ways. (Yes, I know: not on my sites - yet - I want to make a generic piece of code for that, but coding is a ways off while I'm still struggling bringing Christiaan around again.)

   
__________________
Marjolein Katsma
Look through my eyes on Cultural Surfaces (soon!), My ArtFlakes shop and Flickr.
Occasionally I am also connecting online dots... and sometimes you can follow me on Marjolein's Travel Blog
iamback is offline   Reply With Quote
Old 07-07-2006, 04:16 PM   #2
ktinkel
Founding Sysop
 
ktinkel's Avatar
 
Join Date: Oct 2004
Location: In Connecticut, on the Housatonic River near its mouth at Long Island Sound.
Posts: 11,187
Default

Quote:
Originally Posted by iamback
Never use JavaScript only for what is basic functionality. If you obfuscate with JavaScript then (with most, if not all, JS functions for that anyway) you'd end up with no way to contact by email for those who don't use JavaScript for whatever reason.
I have been reading about methods of obfuscating e-mail addresses on web sites.

It is interesting that most agree that only the JavaScript solution is fool-proof. And I have read that most web users do have JS enabled (Someone on the U.C. California/Berkeley site said that 94% do use it; of course, Berkeley users are not what I would call a typical population, much as I enjoy their company!)

I have also found an essay that suggests that it is up to users to defend against spam, not site creators. Hmmm.

Anyway, right now I am considering a solution that uses ‘on mouseover’ to trick spiders from reading e-mail addresses. I will post it below — do you know anything against that:

-------------------------------
Replace me, example.com, and Link text with whatever’s appropriate:
<a href="mail.html" onmouseover="this.href='mai' + 'lto:' + 'me' + '@' + 'example.com'">Link text</a>
Or, to have your link text display something that looks like your e-mail address, then you could do something like this:
<a href="mail.html" onmouseover="this.href='mai' + 'lto:' + 'me' + '@' + 'example.com'">me[at]example.com</a>
which will display as:
me[at]example.com
---------------------------------

   
__________________
[SIZE=2][COLOR=LemonChiffon]::[/COLOR][/SIZE]
[SIGPIC][/SIGPIC]
ktinkel is offline   Reply With Quote
Old 07-07-2006, 10:14 PM   #3
iamback
Member
 
iamback's Avatar
 
Join Date: Oct 2005
Location: Amsterdam, NL
Posts: 4,894
Default

Quote:
Originally Posted by ktinkel
I have been reading about methods of obfuscating e-mail addresses on web sites.

It is interesting that most agree that only the JavaScript solution is fool-proof.
Really? I don't agree though. What makes anything foolproof is the (quality of the) resulting obfuscation, not how it's done; I prefer doing it in PHP but you can hard-code it as well so it's not dependent on JavaScript at all.

Quote:
Originally Posted by ktinkel
And I have read that most web users do have JS enabled (Someone on the U.C. California/Berkeley site said that 94% do use it; of course, Berkeley users are not what I would call a typical population, much as I enjoy their company!)
Most = not all. 5-10% don't. Including most people using a screen reader - do you want to exclude them?

Quote:
Originally Posted by ktinkel
I have also found an essay that suggests that it is up to users to defend against spam, not site creators. Hmmm.
Bull. The website is the first line of defense. Take it from a long-suffering spam victim!

Quote:
Originally Posted by ktinkel
Anyway, right now I am considering a solution that uses ‘on mouseover’ to trick spiders from reading e-mail addresses. I will post it below — do you know anything against that:
Yes! It's JavaScript. (And polluting your HTML as well - JS shouldn't be done like that these days.)

   
__________________
Marjolein Katsma
Look through my eyes on Cultural Surfaces (soon!), My ArtFlakes shop and Flickr.
Occasionally I am also connecting online dots... and sometimes you can follow me on Marjolein's Travel Blog
iamback is offline   Reply With Quote
Old 07-08-2006, 05:12 AM   #4
ktinkel
Founding Sysop
 
ktinkel's Avatar
 
Join Date: Oct 2004
Location: In Connecticut, on the Housatonic River near its mouth at Long Island Sound.
Posts: 11,187
Default

Quote:
Originally Posted by iamback
Most = not all. 5-10% don't. Including most people using a screen reader - do you want to exclude them?
As a general notion, of course not. For a site dedicated to the fine points of typography? Why not.

Quote:
Originally Posted by iamback
Bull. The website is the first line of defense.
That was my thought too. Yes, you can filter out much of the spam; but it is a never-ending job tuning the filters for new stunts. I never find anything tempting in a spam ad (and if I did, I would find a different source, one that wasn’t so rude).

Quote:
Originally Posted by iamback
Yes! It's JavaScript. (And polluting your HTML as well - JS shouldn't be done like that these days.)
Ah, well — no simple substitute for that “onmouseover,” huh? Nothing to do except learn PHP?


::

   
__________________
[SIZE=2][COLOR=LemonChiffon]::[/COLOR][/SIZE]
[SIGPIC][/SIGPIC]
ktinkel is offline   Reply With Quote
Old 07-08-2006, 05:52 AM   #5
iamback
Member
 
iamback's Avatar
 
Join Date: Oct 2005
Location: Amsterdam, NL
Posts: 4,894
Default

Quote:
Originally Posted by ktinkel
As a general notion, of course not. For a site dedicated to the fine points of typography? Why not.
But for a site trying to peddle cottages? Why would you?

There's nothing wrong with using JavaScript; you just shouldn't use it for essential functionality. Unless, maybe, the site is actually about JavaScript - which this one isn't. And blind people book vacations, too - even if it's their partner who drives.

Quote:
Originally Posted by ktinkel
Ah, well — no simple substitute for that “onmouseover,” huh? Nothing to do except learn PHP?
Sure there is - just hard-code it. There are sites that can do the obfuscation for you if you don't want to do it by hand.

If you do want to do it by hand I can teach you how - as long as you have an ASCII table or another thingy that can tell you the ASCII decimal and/or hexadecimal value of a character.

   
__________________
Marjolein Katsma
Look through my eyes on Cultural Surfaces (soon!), My ArtFlakes shop and Flickr.
Occasionally I am also connecting online dots... and sometimes you can follow me on Marjolein's Travel Blog
iamback is offline   Reply With Quote
Old 07-08-2006, 05:54 AM   #6
ktinkel
Founding Sysop
 
ktinkel's Avatar
 
Join Date: Oct 2004
Location: In Connecticut, on the Housatonic River near its mouth at Long Island Sound.
Posts: 11,187
Default

Quote:
Originally Posted by iamback
JS shouldn't be done like that these days.)
How about this SpamSpan approach?

It uses JavaScript if available; if not it produces a human-readable address, in any of three levels of paranoia (as the author puts it): straight text; text with image for the @; or with [at] and [dot] in the address.

So the address is vulnerable to any non-JS-savvy spambot. Does that make sense?


::

   
__________________
[SIZE=2][COLOR=LemonChiffon]::[/COLOR][/SIZE]
[SIGPIC][/SIGPIC]

Last edited by ktinkel; 07-08-2006 at 01:47 PM. Reason: fix typo
ktinkel is offline   Reply With Quote
Old 07-08-2006, 07:30 AM   #7
ktinkel
Founding Sysop
 
ktinkel's Avatar
 
Join Date: Oct 2004
Location: In Connecticut, on the Housatonic River near its mouth at Long Island Sound.
Posts: 11,187
Default

Quote:
Originally Posted by iamback
Sure there is - just hard-code it. There are sites that can do the obfuscation for you if you don't want to do it by hand.

If you do want to do it by hand I can teach you how - as long as you have an ASCII table or another thingy that can tell you the ASCII decimal and/or hexadecimal value of a character.
Ah — that’s what you mean! Using decimal or hex code for each character in the address.

Don’t spambots de-code that? Sounds too easy. Can you mix hex and decimal, or does it matter?

   
__________________
[SIZE=2][COLOR=LemonChiffon]::[/COLOR][/SIZE]
[SIGPIC][/SIGPIC]
ktinkel is offline   Reply With Quote
Old 07-08-2006, 09:28 AM   #8
iamback
Member
 
iamback's Avatar
 
Join Date: Oct 2005
Location: Amsterdam, NL
Posts: 4,894
Default "Strong" obfuscation - manually

Quote:
Originally Posted by ktinkel
Ah — that’s what you mean! Using decimal or hex code for each character in the address.

Don’t spambots de-code that? Sounds too easy. Can you mix hex and decimal, or does it matter?
It is easy - and as far as I know spambots don't decode my obfuscated addresses (yet) - but I use a random mix for "strong obfuscation": they can't use any one method to decode it. Believe me: spambots tend to be lazy - if they get enough usable results, why bother with more complicated detection of email addresses? (I've had a very occasional spam to an obfuscated address, but that was using my name as well - suggesting it was manually harvested, not by a spambot.)

Three methods

The idea is to "treat" each character in the email address in one of three ways:
  1. Don't change anything - just use the character as-is (the idea is to throw off simple pattern-recognition algorithms in hypothetical spambots by using a few non-obfuscated characters)
  2. Use a numeric entity reference: we'll sloppily call this "HTML encoding" as it can be used with any HTML content or attribute value (but not for '<', '>', tag names or attribute names); this method uses the decimal value of the character (It's sometimes mistakenly called "ASCII" but that is not the actual encoding method used here! I mention it just so you can recognize the term in this context.)
  3. Use URL-encoding; this can be used only where a URL (URI-reference) appears in HTML, such as in an href attribute value; this method uses the hexadecimal value of the character
Obviously, you'll need some tool (like a character map or an ASCII table) to determine decimal and hexadecimal values; and to make truly random decisions, use dice (or one die).

The obfuscation algorithm

Got all your tools together? Here goes:
  1. Write out the full email link, like this:
    HTML Code:
    <a href="mailto:john_doe@example.com">John Doe</a>
    It's advisable to not use a plain-text email; address as the link description: use a (person or role) name or a description. If you really must use an email address, see below
  2. You're only going to change the actual email address in the href attribute: the "mailto:" bit (protocol) remains unchanged. So write out the actual email address with enough space for each character to be able to write up to 6 characters below
  3. Now decide on a random method to use, but keep the probability for not encoding a character low. For instance:
    • 1: don't change
    • 2, 3: use "HTML encoding"
    • 4, 5, 6: use URL encoding
  4. For each letter in the email address, decide which method will be applied; then for:
    • don't change: just write the same letter below
    • "HTML encoding": write the code below: "&#" followed by the decimal value of the character, followed by ';'
    • URL encoding: write the code below: "%" followed by the hexadecimal value of the character (nothing after that)
  5. Now replace the email address in your email link with your encoded string
  6. Done!

Notes and refinements
  • When writing out an email address, remember that a domain name (the part after the "@") is case-insensitive: you can actually (maybe) make things a little harder for the spambots by varying uppercase and lower case here. However, depending on the addressee's email server, the name (the part before the "@") may actually be case-sensitive. So if it's not your own address, copy it exactly as given.
  • The letters in hexadecimal code (A thru F) are case-insensitive; you can create an extra little hurdle by varying upper- and lower-case characters while URL-encoding.

No link description?

If you can't (or don't want to) use a link description in the form of a (role) name but want to use the actual email address, you must strike a balance between "weaker" encoding and some possible extra work for your site's visitors.
  • Use some sort of "textual" encoding, by replacing dots, dashes, underscores, etc. with a textual equivalent; using our example address, you could end up with one of these:
    • john_doe [at] example.com
    • john[underscore]doe[at]example[dot]com
    • john-underscore-doe-at-example-dot-com
    • john_doe [at] example [dot] com
    or some variant; make sure to add instructions how to "build" a real email address from that if your audience isn't used to these textual obfuscating formats
  • Now you can obfuscate this string (including any spaces!) as well, if you want - but:
  • Since URL encoding works only for actual URI references (as in href attributes) you cannot use it for a link description which is HTML content; for HTML content only "HTML encoding" will work!
  • Again, decide on a randomization algorithm (except using your die or dice to choose between only two methods: unchanged character and "HTML encoding"), and work through the whole string.

Exercises

Write out the example email address 'john_doe@example.com', and post it here.
Want more practice? Create a "textual obfuscation" for a link description and post that as well.


Have fun confusing the spambots!

   
__________________
Marjolein Katsma
Look through my eyes on Cultural Surfaces (soon!), My ArtFlakes shop and Flickr.
Occasionally I am also connecting online dots... and sometimes you can follow me on Marjolein's Travel Blog
iamback is offline   Reply With Quote
Old 07-08-2006, 11:47 AM   #9
ktinkel
Founding Sysop
 
ktinkel's Avatar
 
Join Date: Oct 2004
Location: In Connecticut, on the Housatonic River near its mouth at Long Island Sound.
Posts: 11,187
Default

Quote:
Originally Posted by iamback
Exercises

Write out the example email address 'john_doe@example.com', and post it here.
Well, I think I did the first, using ASCII numerical code, leaving a few characters in the raw.

But darned if I can show it here, not even without the a href, not even with square brackets instead of angled. Or even on a web page (if I ask Firefox to show me its properties, it reveals the ordinary straight address — shouldn’t it be showing me my underlying code?)

Doesn’t that mean that the spiders have access to the plain name in the end anyway?

Anyway, I have attached a very wide image to show what I did.


::
Attached Thumbnails
Click image for larger version

Name:	obfuscation_01.png
Views:	281
Size:	10.3 KB
ID:	616  

   
__________________
[SIZE=2][COLOR=LemonChiffon]::[/COLOR][/SIZE]
[SIGPIC][/SIGPIC]
ktinkel is offline   Reply With Quote
Old 07-08-2006, 12:57 PM   #10
Steve Rindsberg
Staff
 
Join Date: Nov 2004
Posts: 7,108
Default

>>I have also found an essay that suggests that it is up to users to defend against spam, not site creators. Hmmm.

That seems to relate to usenet postings rather than web sites, and there, the poster may or may not want the email address obfuscated. It should indeed be their choice (especially since it's so simple to do).

   
__________________
Steve Rindsberg
====================
www.pptfaq.com
www.pptools.com
and stuff
Steve Rindsberg is offline   Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Underscore in Email Addresses dthomsen8 Web Site Building & Maintenance 7 02-19-2010 01:46 AM
osx mail help helene silverman General Publishing Topics 6 08-18-2005 11:46 AM


All times are GMT -8. The time now is 07:27 AM.


Powered by vBulletin® Version 3.8.9
Copyright ©2000 - 2020, vBulletin Solutions, Inc.
Contents copyright 2004–2019 Desktop Publishing Forum and its members.