Email obfuscation: What still works in 2023?

Original Article ↗ Hacker News Discussion ↗

Email obfuscation techniques for publishing addresses on the web appear far less critical than they once were, as many people now report low inbox spam thanks to modern filtering and the prevalence of leaked email datasets over web scraping. Commenters debate the trade-offs between simple measures (URL encoding, basic text mangling) and more complex JS/CSS-based or image-based schemes, noting issues with accessibility, copy‑paste usability, and the fact that determined scrapers can often bypass them. A recurring theme is that spam has shifted from random blasts to more “legitimate‑looking” marketing and list‑brokered messages, leading some to favor strategies like per‑site aliases and catch‑all domains to track and block abuse rather than relying on obfuscation alone.

Methodology and Reliability of Results

  • Several commenters question the tiny sample (six bots over a year) and coarse percentages (17/50/67/83%), seeing it as too small to generalize.
  • Confusion over the “control” (unprotected address) and how “blocked spam” is defined; some feel the explanation is unclear or internally inconsistent.
  • One interpretation: all addresses on the same page were hit by some of the same bots, and the “control” is the union of unique spam messages across all addresses.

Is Publicly Posting Email Still a Real Risk?

  • Multiple people report having long-lived, plainly exposed addresses with very manageable spam (from near zero to a few dozen/day, mostly filtered).
  • Some argue the bigger risk now is data breaches and sold lists, not web scraping.
  • Others note new domains or some TLDs (e.g., .us without WHOIS privacy) quickly attract heavy spam.

Spam Filters vs Obfuscation

  • Many say spam is largely “solved” at the inbox level, with modern filters and SMTP-level blocking. Some self-host using Postfix, greylisting, Bayesian filters, etc., and report almost no spam.
  • Counterpoint: false positives still make spam filtering painful for certain business contexts; reducing incoming spam volume is still valuable.
  • General sentiment: obfuscation alone cannot replace filters but can be a supplemental tactic.

Accessibility and Usability Concerns

  • Several note that advanced obfuscation can harm accessibility, especially for screen readers.
  • Suggested workaround: a button + CAPTCHA to reveal plaintext, possibly with audio CAPTCHA, though this raises usability and cost issues.

Techniques and Evasions Discussed

  • Mentioned methods: URL encoding, base64 + JS, XOR in JS, CSS-based reconstruction, WebAssembly tricks, images with text, ARIA roles, hover-to-decode, DOM-shuffled characters.
  • Some report good real-world results with JS/CSS or WASM-based methods; others doubt durability as headless browsers and smarter scrapers spread.
  • Images are seen as still effective but annoying (no copy–paste) and potentially vulnerable to OCR.

Alternative Address Strategies

  • Popular approach: catch-all domains with per-site aliases; easy blacklisting and leak tracing.
  • Variants: salted/hashed or random local parts; “weird” but valid formats (e.g., unusual local parts or TLDs) that may evade simple scrapers.
  • Some are considering abandoning complex schemes in favor of a single public address plus strong filtering.