Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I want to make my email address available on my website and I was wondering if there was any point in using the "(at) (dot)" convention these days. If I was writing a script to trawl for email addresses it would definite contain a match criterion for this. Similarly, for the same reasons it seems unlikely that using the html unicode version of my email would actually be an effective protection. It seems like it wouldn't be worth the inconvenience of not providing an actual link (and not being able to use an image).

The different ways of writing email addresses seem like security though obscurity, but not obscure at all.

So,

  1. will using the "(at) (dot)" convention actually affect whether people get my email address?

  2. Will modern spam filters make the answer to (1) irrelevant?

share|improve this question

2 Answers 2

Some spam bots, yes.

All spam bots, no.

share|improve this answer

Given the high number of address harvesters and their varied effectiveness, there is an extremely gradual continuum between thwarting spam, usability, and developing yet another way to obfuscate. Plenty of harvesters get plenty of emails without having to try very hard, so there's not as massive of an incentive to defeat possible obfuscation as there is with CAPTCHAs.

This article, a bit dated perhaps, shows as much. While I won't say that all the techniques (e.g. using JS) are as effective nowadays, basically every little bit helps. The more effective techniques to reduce spam are also the ones that drastically decrease usability; the links are either not clickable and/or copy-pasting gives garbage.

When I was coding the people page for my research group I basically figured that trying to thwart all the spammers is an impossible task, so I picked an obfuscation method (using JS to decode a string) that gave the best usability (clickable mailto: link) for the majority of people (JS is ubiquitous nowadays), and for the paranoid a fallback to reCAPTCHA mailhide. It's obviously not perfect, but I felt it was a "good-enough" solution.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.