Does a 'mailto:' hyperlink spoil any preceding email obfuscation efforts in PDF?

Question

Assume there is a PDF file which contains the [email protected] email address as an image (the classic obfuscation method). However, what if this image is made clickable with a hyperlink which would contain mailto:[email protected]? In this case, in SumatraPDF, for example, I can

1. hover over this image and see the mailto:[email protected] tooltip;
2. hover over this image and invoke context menu to choose the "Copy Link Address" action (after what, mailto:[email protected] ends up in the OS clipboard);
3. click this image to invoke the corresponding (OS configuration-dependent) action on mailto:[email protected].

Since, SumatraPDF is capable of displaying and copying mailto:[email protected], I assume that this information could be easily extracted by harvesters, couldn't it? Nevertheless, simple grep [email protected] <pdf> and grep mailto <pdf> over such PDF file do not yield any matches.

NOTE:
I have no idea how PDF stores such data. Thus, any details on this, which would accompany and support the answer to the main question, are extremely welcome!

Should one avoid providing a mailto: hyperlink to improve protection and/or not spoil any preceding obfuscation method (whatever it was)?

Answer 1

Certainly all private information in any file that is published online and accessible by a potential adversary is at risk.

Regarding spam this is not the likeliest scenario, as they are plenty other sources of email adresses that require far less effort, such as leaked databases, mailing lists, public profiles of website showing your email address and any kind of public record such as DNS or in Germany the Impressum (which contains contact information of the webmaster and is legally required). There are many more source, and mailto: is harvested specifically from scanned websites containing contact information. I have not found evidence that email harvesting is also done from PDF, but it certainly would be possible.

The conclusion is that it certainly makes sense to remove mailto:, in general treat any information that is contained in a publicly accessible file as analyzed by someone. So if some content is private and you do not want anybody to misuse it, don't put it in. What is removed cannot be misused.