Can spambots access pages available to only registered, authenticated users?

Question

I have a web application where users register and are activated via an email sent to the email address they supplied.

Then there are pages that are only visible to registered users (non-user access is restricted by checking for a User Object in the session).

On these restricted pages I would like to display a listing that includes the email addresses of other users.

Do I still need to take precautions to obfuscate the email addresses so that they are protected from spam bots and the like? Or is it enough that the page isn't accessible to non-authenticated users?

Edit: The emails on my site are not particularly valuable and it is not a site with very sensitive material. I just don't want the users to be bothered with spam.

Answer 1

There are a lot of individual points here. First, let me clear up a few things:

• I personally, consider email addresses Personally Identifiable Information (PIN) and thus needing to be protected. My personal rule of thumb is that if I am asking a user for it, then it is not already known and thus needs to be protected.
• Obfuscation may not always prevent data leakage (emails) but may only slow down or slightly deter the process (but only if implemented properly)
• I assume you have a secured web application and are only asking about if you can reasonably assume safety on pages where users have properly authenticated.

The quick answer is yes (assuming the web app and auth have been implemented properly).

There are important things to consider though:

• Automated 'spambots' can and do infiltrate many systems with authentication mechanisms. For instance, your app as defined merely validates that a registered user has a valid email address, this is easy enough to work around.
• Make sure you implement your authentication processes properly. IE make sure your process to check for the 'user object' is cryptographically secure. without more details on how you do this, I cannot say for certain.

A simple alternative to displaying real email addresses of the users would be to use an email relay service (like craigslist does) or an internal messaging system.