Instead of including their phone number within the post body, Craigslist users are encouraged to enter their phone number in a separate input field. Then, when the post is displayed, a button appears in the post body:

Screenshot from Craigslist showing "show contact info" button.

When you click on the button, Craigslist makes an XHR request that fetches the entire body of the post, including the phone number, and replaces the existing body with the newly fetched body.

How is this more secure? If I'm writing a scraper, all I have to know is the post ID and the URL format of that XHR request and I can get the phone number. So what makes this more secure?

As a side question, is there a better way to protect user phone numbers? I'm creating a product where user phone numbers will be publicly accessible (as they are on Craigslist) and I want to protect them as much as possible.

  • 2
    Without knowing what Craigslist is doing, it's impossible to say. My first suspicion would be that this particular endpoint is rate limited, and/or requests to it get special examination or treatment. – Xander Jun 10 '16 at 17:36
  • 1
    I would encourage you to edit the side question out of this one and ask it as a question on its own (possibly with a reference to this one). It is a more interesting question and deserves to be something more than a sidenote. – Anders Jun 10 '16 at 22:58
  • It makes using a general-purpose scraper impossible to gather the phone numbers (a simple Python script with a regex for phone numbers won't work for example) and forces the developers to actually adapt their scraper to the site. Unless they explicitly target the site most won't bother doing that. – André Borie Jun 13 '16 at 1:43

This is not necessarily directly a security measure. I don't know why this design was made, but I do see an obvious advantage to hiding sensitive information behind an extra click: a non-malicious scraper — such as a search engine — won't include it. So when the listing is gone, so is the private information. If the information was easy to scrape, it could linger for a long time on Google's cache, or even forever on the Web Archive.

  • I'm marking this as the correct answer because it's something I hadn't considered—I wasn't thinking of non-malicious scraping (e.g. Google). It makes sense that you'd want to keep phone numbers out of long-term caches. – David Jun 15 '16 at 0:00

That type of approach does drastically reduce the scraping because it makes it much more complex to do.

Note that there is no ideal way to block it completely since they want the information to be available to the other users. With OCR systems, even placing it as an image is still far from perfect.

  • This is a great point. Although scraping is still possible, it makes it more difficult—"garden fence" security. – David Jun 14 '16 at 23:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.