Assume there is a PDF file which contains the example@example.com email address as an image (the classic obfuscation method). However, what if this image is made clickable with a hyperlink which would contain mailto:example@example.com? In this case, in SumatraPDF, for example, I can

  1. hover over this image and see the mailto:example@example.com tooltip;
  2. hover over this image and invoke context menu to choose the "Copy Link Address" action (after what, mailto:example@example.com ends up in the OS clipboard);
  3. click this image to invoke the corresponding (OS configuration-dependent) action on mailto:example@example.com.

Since, SumatraPDF is capable of displaying and copying mailto:example@example.com, I assume that this information could be easily extracted by harvesters, couldn't it? Nevertheless, simple grep example@example.com <pdf> and grep mailto <pdf> over such PDF file do not yield any matches.

I have no idea how PDF stores such data. Thus, any details on this, which would accompany and support the answer to the main question, are extremely welcome!

Should one avoid providing a mailto: hyperlink to improve protection and/or not spoil any preceding obfuscation method (whatever it was)?


Certainly all private information in any file that is published online and accessible by a potential adversary is at risk.

Regarding spam this is not the likeliest scenario, as they are plenty other sources of email adresses that require far less effort, such as leaked databases, mailing lists, public profiles of website showing your email address and any kind of public record such as DNS or in Germany the Impressum (which contains contact information of the webmaster and is legally required). There are many more source, and mailto: is harvested specifically from scanned websites containing contact information. I have not found evidence that email harvesting is also done from PDF, but it certainly would be possible.

The conclusion is that it certainly makes sense to remove mailto:, in general treat any information that is contained in a publicly accessible file as analyzed by someone. So if some content is private and you do not want anybody to misuse it, don't put it in. What is removed cannot be misused.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.