How To Phish, Protect Your Email, and Defeat Copy-And-Paste with CSS

azarask.in

17 points·aikoto··5 comments

I've been publishing my gmail address in clear view of harvesting spam bots for years. I hardly ever see spam.

Interesting. But something that a few minutes with Selenium could resolve. For each text node, check the visibility and position. If visible and the position is within the bounds of the window, append text to buffer. Else, ignore. }.

Sure, but we're talking about harvesting e-mail addresses from basically any sites you can find. It it's a matter of writing a regexp for the HTML source, it's fine. If it's a matter of running some complicated software with complex rules for each and every site you can find on the net, I think it's less good..

By the way: if you want to write a script for yourself for this purpose (I mean, stripping out invisible/out-of-screen tags), I think it can turn really difficult pretty fast because of the cascading nature of CSS and the possibility of the complex rules you can generate. So basically you'll have to interpret the whole CSS tree and count the position of every element, taking into account all the rules of CSS - for me it feels like implementing half of a browser's rendering engine. Oh, and have we talked about the possibility of setting a CSS property from JS? (eg. making every tag hidden and then show the 'true' e-mail address after the JS has loaded)

If I wanted to e-mail you, I wouldn't be able to copy and paste your e-mail address into Gmail.

double clicking to select the URL reveals funny business, since its not possible (At least in chrome)

Reply on news.ycombinator.com