Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm on WordPress trying to keep spambots from grabbing email addresses that may be in The Content. WordPress has a nifty little function simply called antispambot() which will convert the email address into HTML Entities.

no-reply@domain.com converts to:

no-reply@domain.com

This function has been around for a LONG time and I'm sure the method has been around for longer so my question is: Is this still a valid way to beat spambots? Will this method still fool spambots and keep said email safe?

share|improve this question

4 Answers 4

up vote 4 down vote accepted

No, that's not going to fool spambots. I've seen a couple of spambots that were parsing the entire DOM using tools like html5lib or comparables. Of course, many spammers just "guess" at email addresses: the cost of sending emails when you have a botnet is basically 0, so making combinations of username & domains to guess works out well.

Slightly better techniques I've seen have involved using javascript to render the email address into the DOM at runtime. A spambot would need to be running in a browser or use something like WebDriver to get at those.

But, in all reality, hiding your email address is a losing battle. A contact's address book might be compromised, or you might miss one place where its posted, and then you're back where you started. Good filtering is probably a better investment of time & energy.

share|improve this answer

Keeping an email "safe" is nigh impossible. In particular, there are widely deployed malware that inspect the address book of infected systems, in order to:

  1. gather the emails themselves for spamming purposes;
  2. send themselves to these people so as to spread the infection.

To see your email becoming part of spamming lists, it suffices that one of the people with whom you exchange emails gets some malware on his system (that you have no control over). Once your email has been disclosed, the war is lost, because spammers never forget(*). The only realistic way to never receive any spam on your email is to not have an email at all (that's what Donald Knuth does).

However, though such techniques for preventing email gathering are actually ineffective, some people may feel that it is your responsibility to call antispambot(). In that sense, you should keep on using that function; not because it works (it doesn't), but because it appeases (some) users.

(*) I once destroyed an email address because it was still receiving dozens of spams daily, five years after I had totally stopped using it. After more than 20000 spams and not a single non-spam email, I decided that it was time to put an end to its misery.

share|improve this answer

Protecting email addresses with JavaScript seems an effective way. I have email addresses out on a few webpages quite a long time, and never received spam mails for them. At least for email-adresses which you have to share on a homepage, this gives a little peace to their owners.

The email addresses are written backwards and a JavaScript is reversing them. Spam bots do not seem to care, as soon as something potentially expensive like a for-loop is involved. Of course this can change in future though.

share|improve this answer

Any working web scraper actually has to decode HTML entities, because characters like “<” or “>” (which can also appear in e-mail addresses) are always encoded when they occur as data. So decoding of entities isn't even a a special “attack feature”. It's a natural functionality.

Your only hope would be that the authors of the spambot somehow don't understand HTML or needed to reduce the text processing to the absolute minimum. But that's very thin ice.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.