Taking care of other people's email info

Best practices?

[buckworks]

This week I became aware that a certain site has posted contact info for a number of businesses in an industry I'm connected with, without doing a thing to protect their email addresses against spam bots. They're all just sitting there as clickable mailto: links, totally exposed in the source code.

The webmaster (who is not the site's owner) says in effect, there's no point even trying to disguise anyone's email, as spam bots can see through all the disguises anyhow.

I was surprised at his thinking, but he's usually a pretty savvy webmaster so I'm wondering what I'm missing here.

What are the best practices these days for a responsible site to protect other people's email info (aside from taking it right out of the listings, which I already suggested)?

[wheel]

There's a way to mangle email addresses using javascript so that they display properly and are clickable, but don't read well by spambots. I've stickied you a site where we do this. I'm not sure of the specifics though as a developer set it up for me.

[wheel]

I should clarify that I don't know if spambots will see through the javascript. I just expressed an interest in the solution and that's what the developer came up with. Seems like it should work if for no other reason than I would assume it's too much work for harvesters to get into that...but I don't have any info either way.

[Rosalind]

It's not impossible for spambots to get around the javascript solution. Whether they do or not will depend on how many webmasters are implementing some sort of blocking. In other words, if there are enough naked email addresses for them, then for the most part they won't bother with the protected addresses.

Security is all a matter of degree, so there are lots of things to do to make emails safer, but none of them are perfect. You can make the addresses visible only to registered users, or only to visitors who accept a cookie. Or you could use a CAPTCHA.

Spambots don't usually identify themselves, so robots.txt is no use. But occasionally you can ban bots by IP address or user agent. This is probably the worst solution though, since the webmaster is left continually playing catch-up with the latest incarnations of all the bots.

Spambots may be able to see through most disguises, but in practice they don't usually bother because it takes up their resources.