Comments on: How to Guarantee Your Site is Blacklisted for Email http://marketingtechblog.com/2008/02/19/email-form-vulnerability/ new media strategies and other marketing gems Mon, 06 Jul 2009 17:14:21 -0400 http://wordpress.org/?v=2.8 hourly 1 By: Douglas Karr http://marketingtechblog.com/2008/02/19/email-form-vulnerability/comment-page-1/#comment-99850 Douglas Karr Sat, 12 Apr 2008 15:50:52 +0000 http://marketingtechblog.com/2008/02/19/email-form-vulnerability/#comment-99850 Spammers have very complex crawling mechanisms that are able to harvest email addresses in a number of ways. I'd honestly be weary of ever putting my email address on a web page and would, instead, deploy a contact form. Spammers have very complex crawling mechanisms that are able to harvest email addresses in a number of ways. I’d honestly be weary of ever putting my email address on a web page and would, instead, deploy a contact form.

]]> By: Douglas Karr http://marketingtechblog.com/2008/02/19/email-form-vulnerability/comment-page-1/#comment-99849 Douglas Karr Sat, 12 Apr 2008 15:49:02 +0000 http://marketingtechblog.com/2008/02/19/email-form-vulnerability/#comment-99849 Hi Roger, As a visitor, you're not in any danger. The issue is for the people who put up this form. A Spammer is able to 'highjack' the form and send spam out using it. It's a terrible practice that the company has deployed on their website. Doug Hi Roger,

As a visitor, you’re not in any danger. The issue is for the people who put up this form. A Spammer is able to ‘highjack’ the form and send spam out using it. It’s a terrible practice that the company has deployed on their website.

Doug

]]> By: Roger http://marketingtechblog.com/2008/02/19/email-form-vulnerability/comment-page-1/#comment-99711 Roger Sat, 12 Apr 2008 08:32:29 +0000 http://marketingtechblog.com/2008/02/19/email-form-vulnerability/#comment-99711 One more question....if I absolutely must put my email address on a page, then what is the best way to do it? Is it safe to use hexidecimal character codes? Thanks One more question….if I absolutely must put my email address on a page, then what is the best way to do it? Is it safe to use hexidecimal character codes?

Thanks

]]> By: Roger http://marketingtechblog.com/2008/02/19/email-form-vulnerability/comment-page-1/#comment-99709 Roger Sat, 12 Apr 2008 08:29:05 +0000 http://marketingtechblog.com/2008/02/19/email-form-vulnerability/#comment-99709 Hello, I found your blog post very interesting, but I don't understand exactly how this works. If you fill in this form, how do the spam bots get your email address? If the site has hidden fields with your email address all the time, then it's obvious how the spam bots get them. But when you're filling it out, don't you just hit submit, and then the hidden fields go away, right? Does the spam bot have a program set on that page that captures what you type in or what the site puts in the hidden fields while you're using it? I don't understand. Can you please explain this more? And what can be done? How do you implement a form that spam bots can't do this too? Is it just a matter of not using hidden fields for email addresses or is it more than that? Thanks Hello,

I found your blog post very interesting, but I don’t understand exactly how this works.

If you fill in this form, how do the spam bots get your email address?

If the site has hidden fields with your email address all the time, then it’s obvious how the spam bots get them.

But when you’re filling it out, don’t you just hit submit, and then the hidden fields go away, right? Does the spam bot have a program set on that page that captures what you type in or what the site puts in the hidden fields while you’re using it?

I don’t understand. Can you please explain this more?

And what can be done? How do you implement a form that spam bots can’t do this too? Is it just a matter of not using hidden fields for email addresses or is it more than that?

Thanks

]]> By: Stephen James http://marketingtechblog.com/2008/02/19/email-form-vulnerability/comment-page-1/#comment-87373 Stephen James Thu, 21 Feb 2008 20:31:04 +0000 http://marketingtechblog.com/2008/02/19/email-form-vulnerability/#comment-87373 I believe PDFs are plain text (at least Google can spider them) and your email is in your resume, Doug. I believe PDFs are plain text (at least Google can spider them) and your email is in your resume, Doug.

]]> By: Stephen James http://marketingtechblog.com/2008/02/19/email-form-vulnerability/comment-page-1/#comment-87369 Stephen James Thu, 21 Feb 2008 20:26:59 +0000 http://marketingtechblog.com/2008/02/19/email-form-vulnerability/#comment-87369 I understand what both of you are saying. To me, a contact form feels is like a 1-800 number instead of a mobile number on a business card. It feels way too corporate/support ticket. I have yet to see spam show up at my wife's email that I do JavaScript obfuscation at <a href="http://www.rachelsteely.com/contact/" rel="nofollow">www.rachelsteely.com</a>, but that sites only been up a month. I would never tell a friend to put their email address out in the wild if they didn't know what they were doing. I would probably have given up long ago, too if I didn't have Google as my anti-spam software. I understand what both of you are saying. To me, a contact form feels is like a 1-800 number instead of a mobile number on a business card. It feels way too corporate/support ticket.

I have yet to see spam show up at my wife’s email that I do JavaScript obfuscation at http://www.rachelsteely.com, but that sites only been up a month. I would never tell a friend to put their email address out in the wild if they didn’t know what they were doing. I would probably have given up long ago, too if I didn’t have Google as my anti-spam software.

]]> By: Ade http://marketingtechblog.com/2008/02/19/email-form-vulnerability/comment-page-1/#comment-86278 Ade Tue, 19 Feb 2008 17:49:54 +0000 http://marketingtechblog.com/2008/02/19/email-form-vulnerability/#comment-86278 @Stephen You're right that a lot of programmers who write spam bots are lazy. I mean, you can just parse the results of http://tinyurl.com/yuje9z and get hundreds of thousands of addresses to spam. But email addresses hidden in JavaScript, images and Flash aren't safe either. See http://www.cryptologie.com/SpamFull.pdf for a study a few years back. "Some of them resolve ASCII protection and even basic javascript or flash code." The best protection is still to stop publishing email addresses, and use a <a href="http://www.formspring.com" rel="nofollow">web form</a> instead. @Stephen You’re right that a lot of programmers who write spam bots are lazy. I mean, you can just parse the results of http://tinyurl.com/yuje9z and get hundreds of thousands of addresses to spam.

But email addresses hidden in JavaScript, images and Flash aren’t safe either. See http://www.cryptologie.com/SpamFull.pdf for a study a few years back. “Some of them resolve ASCII protection and even basic javascript or flash code.”

The best protection is still to stop publishing email addresses, and use a web form instead.

]]> By: Douglas Karr http://marketingtechblog.com/2008/02/19/email-form-vulnerability/comment-page-1/#comment-86265 Douglas Karr Tue, 19 Feb 2008 16:35:54 +0000 http://marketingtechblog.com/2008/02/19/email-form-vulnerability/#comment-86265 Hi Stephen, "skeptical of anyone who doesn't have an email address listed"... ouch! If I had my email address out on my blog, even with a JavaScript obfuscator, I would get tens of thousands of spam a day. Don't be skeptical - we're only trying to protect ourselves. The purpose of the contact for IS so that folks can still get in touch with us without leaving us open for spambots. Doug Hi Stephen,

“skeptical of anyone who doesn’t have an email address listed”… ouch! If I had my email address out on my blog, even with a JavaScript obfuscator, I would get tens of thousands of spam a day.

Don’t be skeptical – we’re only trying to protect ourselves. The purpose of the contact for IS so that folks can still get in touch with us without leaving us open for spambots.

Doug

]]> By: Stephen James http://marketingtechblog.com/2008/02/19/email-form-vulnerability/comment-page-1/#comment-86261 Stephen James Tue, 19 Feb 2008 16:19:10 +0000 http://marketingtechblog.com/2008/02/19/email-form-vulnerability/#comment-86261 I agree. Email address should never be in plain sight/code. In the last few months, I've started always doing JavaScript replacement code--although I'm hesitant to promote that since I'm sure many spambots can read it. I hope that many of them are too lazy to parse the JS and just grab the low hanging fruit. I'm guessing that the spambots have also become good at parsing "account at domain dot com" listed addresses, too. Personally, I'm skeptical of anyone what doesn't have an email address listed on their blog and only a contact form, but it seems that is the only 100% way to do it. I also like image email addresses that people can see but have to type in. Maybe embedded Flash would be another route. Are you a contact form only guy? I agree. Email address should never be in plain sight/code. In the last few months, I’ve started always doing JavaScript replacement code–although I’m hesitant to promote that since I’m sure many spambots can read it. I hope that many of them are too lazy to parse the JS and just grab the low hanging fruit. I’m guessing that the spambots have also become good at parsing “account at domain dot com” listed addresses, too.

Personally, I’m skeptical of anyone what doesn’t have an email address listed on their blog and only a contact form, but it seems that is the only 100% way to do it. I also like image email addresses that people can see but have to type in. Maybe embedded Flash would be another route. Are you a contact form only guy?

]]>