Instead of including their phone number within the post body, Craigslist users are encouraged to enter their phone number in a separate input field. Then, when the post is displayed, a button appears in the post body:
When you click on the button, Craigslist makes an XHR request that fetches the entire body of the post, including the phone number, and replaces the existing body with the newly fetched body.
How is this more secure? If I'm writing a scraper, all I have to know is the post ID and the URL format of that XHR request and I can get the phone number. So what makes this more secure?
As a side question, is there a better way to protect user phone numbers? I'm creating a product where user phone numbers will be publicly accessible (as they are on Craigslist) and I want to protect them as much as possible.