Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #233853 > unrolled thread

Re: Modern best practice for putting a contact email on the web

Back to article view | Back to linux.debian.user

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: Modern best practice for putting a contact email on the web Dan Ritter <dsr@randomstring.org> - 2021-04-05 22:00 +0200
    Re: Modern best practice for putting a contact email on the web Celejar <celejar@gmail.com> - 2021-04-05 22:20 +0200
      Re: Modern best practice for putting a contact email on the web Henning Follmann <hfollmann@itcfollmann.com> - 2021-04-05 23:10 +0200
      Re: Modern best practice for putting a contact email on the web Dan Ritter <dsr@randomstring.org> - 2021-04-06 01:50 +0200
        Re: Modern best practice for putting a contact email on the web Jim Popovitch <jim@k4vqc.com> - 2021-04-06 02:00 +0200
          Re: Modern best practice for putting a contact email on the web Dan Ritter <dsr@randomstring.org> - 2021-04-06 02:30 +0200
            Re: Modern best practice for putting a contact email on the web Jim Popovitch <jim@k4vqc.com> - 2021-04-06 02:40 +0200
        Re: Modern best practice for putting a contact email on the web Celejar <celejar@gmail.com> - 2021-04-06 03:00 +0200
          Re: Modern best practice for putting a contact email on the web Stefan Monnier <monnier@iro.umontreal.ca> - 2021-04-06 03:40 +0200
            Re: Modern best practice for putting a contact email on the web Celejar <celejar@gmail.com> - 2021-04-06 04:00 +0200
      Re: Modern best practice for putting a contact email on the web "Alexander V. Makartsev" <avbetev@gmail.com> - 2021-04-06 08:40 +0200
        Re: Modern best practice for putting a contact email on the web Celejar <celejar@gmail.com> - 2021-04-06 14:20 +0200

#233853 — Re: Modern best practice for putting a contact email on the web

Celejar wrote: 
> On Mon, 5 Apr 2021 14:12:07 -0400
> Dan Ritter <dsr@randomstring.org> wrote:
> 
> > Celejar wrote: 
> > > Hi,
> > > 
> > > What's the recommended modern best practice for putting a contact email
> > > address on the web while avoiding having it scraped by spam / fraud
> > > bots?
> > 
> > Assume that every address will be hit by spammers and scammers.
> > Put in appropriate antispam and antimalware precautions.
> 
> Okay, but why isn't trying to limit spammers getting hold of an address
> a logical part of a defense in depth strategy?

Because it doesn't work. If it worked as well as, say, moving
your SSH port*, I would encourage it. It does not.

*Moving your SSH port does nothing for your security; it does
reduce the number of log entries to ignore.

> > Train your people to recognize spam and scams.
> 
> I'm talking about a small hobby project that I run in my spare time. I
> just want to reduce spam to an address that I may put up to allow
> people to reach me.

OK, use tagged addresses. Gmail has that feature for free.

I'll give you an example: when I registered for an account on
tvtropes.org, I handed them dsr-tropes@randomstring.org.

A few months later, I knew that their database had been raided,
and since I had never received anything useful at that address, 
I told my mailfilter to drop dsr-tropes@ into the spam bin.

celejar+debianusers@gmail.com will be directed to your GMail
account. So will celejar+celerysticks@, celejar+support@, and
celejar+supportApril2021@gmail.com.

When the spam load becomes too much, change it on the support
page and tell Gmail to spam-bin the old address.

-dsr-

[toc] | [next] | [standalone]

#233854

On Mon, 5 Apr 2021 15:51:28 -0400
Dan Ritter <dsr@randomstring.org> wrote:

> Celejar wrote: 
> > On Mon, 5 Apr 2021 14:12:07 -0400
> > Dan Ritter <dsr@randomstring.org> wrote:
> > 
> > > Celejar wrote: 
> > > > Hi,
> > > > 
> > > > What's the recommended modern best practice for putting a contact email
> > > > address on the web while avoiding having it scraped by spam / fraud
> > > > bots?
> > > 
> > > Assume that every address will be hit by spammers and scammers.
> > > Put in appropriate antispam and antimalware precautions.
> > 
> > Okay, but why isn't trying to limit spammers getting hold of an address
> > a logical part of a defense in depth strategy?
> 
> Because it doesn't work. If it worked as well as, say, moving
> your SSH port*, I would encourage it. It does not.

Source? Is this your personal experience, or do you have some other
basis for this? Cloudflare, for example, asserts that:

"Cloudflare Email Address Obfuscation helps in spam prevention by
hiding email addresses appearing in your pages from email harvesters
and other bots, while remaining visible to your site visitors."

https://support.cloudflare.com/hc/en-us/articles/200170016-What-is-Email-Address-Obfuscation-

...

> > > Train your people to recognize spam and scams.
> > 
> > I'm talking about a small hobby project that I run in my spare time. I
> > just want to reduce spam to an address that I may put up to allow
> > people to reach me.
> 
> OK, use tagged addresses. Gmail has that feature for free.
> 
> I'll give you an example: when I registered for an account on
> tvtropes.org, I handed them dsr-tropes@randomstring.org.
> 
> A few months later, I knew that their database had been raided,
> and since I had never received anything useful at that address, 
> I told my mailfilter to drop dsr-tropes@ into the spam bin.
> 
> celejar+debianusers@gmail.com will be directed to your GMail
> account. So will celejar+celerysticks@, celejar+support@, and
> celejar+supportApril2021@gmail.com.
> 
> When the spam load becomes too much, change it on the support
> page and tell Gmail to spam-bin the old address.

Worth considering, certainly. I try to avoid Gmail as much as possible
(I know that I'm still using it for d-u), but I can check to see
whether the other email providers I use support plus addressing.

Thanks,

Celejar

[toc] | [prev] | [next] | [standalone]

#233867

On Mon, Apr 05, 2021 at 04:14:52PM -0400, Celejar wrote:
> On Mon, 5 Apr 2021 15:51:28 -0400
> Dan Ritter <dsr@randomstring.org> wrote:
> 
> > Celejar wrote: 
> > > On Mon, 5 Apr 2021 14:12:07 -0400
> > > Dan Ritter <dsr@randomstring.org> wrote:
> > > 
> > > > Celejar wrote: 
> > > > > Hi,
> > > > > 
> > > > > What's the recommended modern best practice for putting a contact email
> > > > > address on the web while avoiding having it scraped by spam / fraud
> > > > > bots?
> > > > 
> > > > Assume that every address will be hit by spammers and scammers.
> > > > Put in appropriate antispam and antimalware precautions.
> > > 
> > > Okay, but why isn't trying to limit spammers getting hold of an address
> > > a logical part of a defense in depth strategy?
> > 
> > Because it doesn't work. If it worked as well as, say, moving
> > your SSH port*, I would encourage it. It does not.
> 
> Source? Is this your personal experience, or do you have some other
> basis for this? Cloudflare, for example, asserts that:

And what is their "source"? Judging by current spam pattern on the email
server I administer, cloudflare (and sendgrid, google, MS) are a big
contributer to spam by sneaking mail by dnsbl filter. They are rather a
big part of the problem than part of an solution.


> 
> "Cloudflare Email Address Obfuscation helps in spam prevention by
> hiding email addresses appearing in your pages from email harvesters
> and other bots, while remaining visible to your site visitors."

<cynical>Sure, bud!</cynical>


> 
> https://support.cloudflare.com/hc/en-us/articles/200170016-What-is-Email-Address-Obfuscation-
>

-H

-- 
Henning Follmann           | hfollmann@itcfollmann.com

[toc] | [prev] | [next] | [standalone]

#233871

Celejar wrote: 
> On Mon, 5 Apr 2021 15:51:28 -0400
> Dan Ritter <dsr@randomstring.org> wrote:
> 
> > > Okay, but why isn't trying to limit spammers getting hold of an address
> > > a logical part of a defense in depth strategy?
> > 
> > Because it doesn't work. If it worked as well as, say, moving
> > your SSH port*, I would encourage it. It does not.
> 
> Source? Is this your personal experience, or do you have some other
> basis for this? Cloudflare, for example, asserts that:
> 
> "Cloudflare Email Address Obfuscation helps in spam prevention by
> hiding email addresses appearing in your pages from email harvesters
> and other bots, while remaining visible to your site visitors."

Source: experience from being actively involved in the Internet
for 25 years, including time on anti-spam initiatives at BBN and
Akamai, various mail anti-abuse working groups (now
https://www.m3aawg.org/ which I'm not currently involved with
particularly) and running personal and corporate mail servers
for most of that time.


> > OK, use tagged addresses. Gmail has that feature for free.
> > 
> > page and tell Gmail to spam-bin the old address.
> 
> Worth considering, certainly. I try to avoid Gmail as much as possible
> (I know that I'm still using it for d-u), but I can check to see
> whether the other email providers I use support plus addressing.

The good ones will. The best ones will also offer - addressing
on the same terms. Turns out that a bunch of idiots think that +
is not a valid mail left-hand-side character, but - is.

-dsr-

[toc] | [prev] | [next] | [standalone]

#233873

On Mon, 2021-04-05 at 19:39 -0400, Dan Ritter wrote:
> Celejar wrote: 
> > On Mon, 5 Apr 2021 15:51:28 -0400
> > Dan Ritter <dsr@randomstring.org> wrote:
> > 
> > > > Okay, but why isn't trying to limit spammers getting hold of an address
> > > > a logical part of a defense in depth strategy?
> > > 
> > > Because it doesn't work. If it worked as well as, say, moving
> > > your SSH port*, I would encourage it. It does not.
> > 
> > Source? Is this your personal experience, or do you have some other
> > basis for this? Cloudflare, for example, asserts that:
> > 
> > "Cloudflare Email Address Obfuscation helps in spam prevention by
> > hiding email addresses appearing in your pages from email harvesters
> > and other bots, while remaining visible to your site visitors."
> 
> Source: experience from being actively involved in the Internet
> for 25 years, including time on anti-spam initiatives at BBN and
> Akamai, various mail anti-abuse working groups (now
> https://www.m3aawg.org/ which I'm not currently involved with
> particularly) and running personal and corporate mail servers
> for most of that time.

With experiences like that, you should be already well on your way to
taking care of this: 

https://www.spamhaus.org/css/removal/record/2600:3c03::f03c:91ff:fe25:c4ae

Your emails keep going into Spam/Bulk folders. :)

Best wishes,

-Jim P.

[toc] | [prev] | [next] | [standalone]

#233874

Jim Popovitch wrote: 
> On Mon, 2021-04-05 at 19:39 -0400, Dan Ritter wrote:
> With experiences like that, you should be already well on your way to
> taking care of this: 
> 
> https://www.spamhaus.org/css/removal/record/2600:3c03::f03c:91ff:fe25:c4ae
> 
> Your emails keep going into Spam/Bulk folders. :)

They do that every so often. Spamhaus doesn't like Linode, and I
have a VM there that occasionally forwards mail for me.

I ask them to unban it, they do, then a few weeks or months
later they blanket-ban Linode again.

If it were more of an issue for me, I might consider switching.

-dsr-

[toc] | [prev] | [next] | [standalone]

#233876

On Mon, 2021-04-05 at 20:18 -0400, Dan Ritter wrote:
> Jim Popovitch wrote: 
> > On Mon, 2021-04-05 at 19:39 -0400, Dan Ritter wrote:
> > With experiences like that, you should be already well on your way to
> > taking care of this: 
> > 
> > https://www.spamhaus.org/css/removal/record/2600:3c03::f03c:91ff:fe25:c4ae
> > 
> > Your emails keep going into Spam/Bulk folders. :)
> 
> They do that every so often. Spamhaus doesn't like Linode, and I
> have a VM there that occasionally forwards mail for me.
> 
> I ask them to unban it, they do, then a few weeks or months
> later they blanket-ban Linode again.
> 
> If it were more of an issue for me, I might consider switching.

Try sending via ipv4 only to lists.d.o, etc.

-Jim P.

[toc] | [prev] | [next] | [standalone]

#233877

On Mon, 5 Apr 2021 19:39:43 -0400
Dan Ritter <dsr@randomstring.org> wrote:

> Celejar wrote: 
> > On Mon, 5 Apr 2021 15:51:28 -0400
> > Dan Ritter <dsr@randomstring.org> wrote:
> > 
> > > > Okay, but why isn't trying to limit spammers getting hold of an address
> > > > a logical part of a defense in depth strategy?
> > > 
> > > Because it doesn't work. If it worked as well as, say, moving
> > > your SSH port*, I would encourage it. It does not.
> > 
> > Source? Is this your personal experience, or do you have some other
> > basis for this? Cloudflare, for example, asserts that:
> > 
> > "Cloudflare Email Address Obfuscation helps in spam prevention by
> > hiding email addresses appearing in your pages from email harvesters
> > and other bots, while remaining visible to your site visitors."
> 
> Source: experience from being actively involved in the Internet
> for 25 years, including time on anti-spam initiatives at BBN and
> Akamai, various mail anti-abuse working groups (now
> https://www.m3aawg.org/ which I'm not currently involved with
> particularly) and running personal and corporate mail servers
> for most of that time.

Sounds good to me :)

> > > OK, use tagged addresses. Gmail has that feature for free.
> > > 
> > > page and tell Gmail to spam-bin the old address.
> > 
> > Worth considering, certainly. I try to avoid Gmail as much as possible
> > (I know that I'm still using it for d-u), but I can check to see
> > whether the other email providers I use support plus addressing.
> 
> The good ones will. The best ones will also offer - addressing
> on the same terms. Turns out that a bunch of idiots think that +
> is not a valid mail left-hand-side character, but - is.

I use some GMX accounts, and they apparently don't support plus
addressing (I just tried, and the message was refused with "550
Requested action not taken: mailbox unavailable."). I suppose it would be
nice if they did support it, but I can't really fault them for not
supporting a non-standard Google invention.

Celejar

[toc] | [prev] | [next] | [standalone]

#233879

> I use some GMX accounts, and they apparently don't support plus
> addressing (I just tried, and the message was refused with "550
> Requested action not taken: mailbox unavailable."). I suppose it would be
> nice if they did support it, but I can't really fault them for not
> supporting a non-standard Google invention.

It predates Google by a long shot.
It was a fairly standard config option back in the days of sendmail+procmail.


        Stefan

[toc] | [prev] | [next] | [standalone]

#233880

On Mon, 05 Apr 2021 21:31:16 -0400
Stefan Monnier <monnier@iro.umontreal.ca> wrote:

> > I use some GMX accounts, and they apparently don't support plus
> > addressing (I just tried, and the message was refused with "550
> > Requested action not taken: mailbox unavailable."). I suppose it would be
> > nice if they did support it, but I can't really fault them for not
> > supporting a non-standard Google invention.
> 
> It predates Google by a long shot.
> It was a fairly standard config option back in the days of sendmail+procmail.

Thanks for the correction. I just haven't been able to figure out how
much of a "standard" it actually is. Some RFCs (e.g.,
https://tools.ietf.org/html/rfc5233) acknowledge it as existing ("On
email systems that allow for 'subaddressing' or 'detailed
addressing' (e.g., "ken+sieve@example.org") ..."), but it doesn't seem
to be a formal standard.

Celejar

[toc] | [prev] | [next] | [standalone]

#233884

[Multipart message — attachments visible in raw view] — view raw

On 06.04.2021 01:14, Celejar wrote:
>> On Mon, 5 Apr 2021 15:51:28 -0400
>> Dan Ritter <dsr@randomstring.org> wrote:
>> Because it doesn't work. If it worked as well as, say, moving your 
>> SSH port*, I would encourage it. It does not. 
> Source? Is this your personal experience, or do you have some other
> basis for this? Cloudflare, for example, asserts that:
>
> "Cloudflare Email Address Obfuscation helps in spam prevention by
> hiding email addresses appearing in your pages from email harvesters
> and other bots, while remaining visible to your site visitors."
>
I think you see spam problem from the wrong perspective.
You might think "spammer" is a person with some home brewed script that 
pray upon unsuspecting web-sites.
Spam is a whole industry and there are large spam groups who make profit 
from spam alone. They are capable to create private and commercial 
applications for data-mining and constantly update them with new tricks 
to fight new obfuscation methods for an example.
They use collected data to create databases of emails (categorize them, 
add country\area information, etc) which later could be traded among 
spam community members and\or sold to companies who want to implement 
aggressive advertisements.
So once your email, even if it was obfuscated, gets into said databases 
there is no escape from spam.
This is the reason why obfuscation doesn't work.

-- 
With kindest regards, Alexander.

⢀⣴⠾⠻⢶⣦⠀
⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system
⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org
⠈⠳⣄⠀⠀⠀⠀

[toc] | [prev] | [next] | [standalone]

#233895

On Tue, 6 Apr 2021 11:31:29 +0500
"Alexander V. Makartsev" <avbetev@gmail.com> wrote:

> On 06.04.2021 01:14, Celejar wrote:
> >> On Mon, 5 Apr 2021 15:51:28 -0400
> >> Dan Ritter <dsr@randomstring.org> wrote:
> >> Because it doesn't work. If it worked as well as, say, moving your 
> >> SSH port*, I would encourage it. It does not. 
> > Source? Is this your personal experience, or do you have some other
> > basis for this? Cloudflare, for example, asserts that:
> >
> > "Cloudflare Email Address Obfuscation helps in spam prevention by
> > hiding email addresses appearing in your pages from email harvesters
> > and other bots, while remaining visible to your site visitors."
> >
> I think you see spam problem from the wrong perspective.
> You might think "spammer" is a person with some home brewed script that 
> pray upon unsuspecting web-sites.

I understand that they use sophisticated bots, not home-brewed scripts.

> Spam is a whole industry and there are large spam groups who make profit 
> from spam alone. They are capable to create private and commercial 
> applications for data-mining and constantly update them with new tricks 
> to fight new obfuscation methods for an example.
> They use collected data to create databases of emails (categorize them, 
> add country\area information, etc) which later could be traded among 
> spam community members and\or sold to companies who want to implement 
> aggressive advertisements.
> So once your email, even if it was obfuscated, gets into said databases 
> there is no escape from spam.
> This is the reason why obfuscation doesn't work.

I understand your points, but at the end of the day, it still seems
plausible to me that obfuscation could reduce (not eliminate, of
course) the prevalence of a posted address in their various lists. I
have a number of email addresses, and some get a lot more spam than
others, so there's apparently no one central, authoritative spammer
list that all email addresses quickly end up on.

I do understand the consensus here, though, of people with more
experience than I have, that obfuscation today is of little or no
value. Here are some other discussions of the question I've come
across, although some are ancient:

https://www.w3.org/blog/systeam/2008/09/11/email_address_obfuscation/
https://stackoverflow.com/questions/748780/best-way-to-obfuscate-an-e-mail-address-on-a-website
https://blog.mailtrap.io/email-obfuscation/

Celejar

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web