Provided a link to your plugin from my page.

Julian,

Thanks for stopping by and letting me know about the email addy outside the norm… I really appreciate it. I have no complains about the functioning of emailshroud plugin for the site. I have had no problem with it playing nice with the other plugins on the site.

richard

Nice, seems works without a hitch, but since the complete email address is still in the source (although separated from the mailto:) are you sure they can’t still be harvested?

Thanks John!

The aim of EmailShroud is to make it hard enough to harvest the email address that spammers don’t bother, and instead look elsewhere – or even better, get a real job.

You raise an important point, that I have considered carefully.

If EmailShroud became insanely popular, it might start to become worthwhile for a spammer to automate the detection of EmailShroud and decode the addresses.

I did start out with some ambitious plans to encrypt the email address with a randomised secret key to make this even more secure, but I realised I was kidding myself. I will deal with the encumbent problems of overwhelming popularity when (and if) they occur. Until then, the simple obfuscation should be more than sufficient. It’ll also load faster than a full solution.

When the proportion of WordPress blogs that use EmailShroud rises above, say, 0.5%, come right back here for a slower, more secure solution!

There is another action plan you could include, or which could even replace the “transform address” option. Generate a random textlogo of the email and use inline CSS to shrink it down to resemble normal text.
A proof-of-concept is in my link.
Even with javascript and images turned off in a browser it will display. If styling is turned off it’s just shown unshrunken.

EmailShroud 1.0.1 has now been tested against WordPress 2.0; it works without modification.

Mardeg’s solution is a cunning one. The Javascript draws your email address as ASCII art, and shrinks down the characters to one-pixel high to make it bit-mapped ASCII art! Nice trick!

The downside, to quote Mardeg, is that it is the “most bloated human-readable email hider in the world!” A quick test took 9KB to include a 14-character email address!

I don’t plan to add this option to EmailShroud but will reconsider if there is demand.

Note to self:

Features I would like to add, one day, include:

* Appropriate license agreement to explain you can freely change the code, but I would appreciate you letting me know, and leaving my name on there somewhere.

* While it works fine under the old-style (numeric) user levels, it would be prettier to explicitly use the new WP 2.0 roles.

* Adding a “no follow” tag to the generated HTML would mean that Google would pointlessly hit my site, less often.

* It would be cool to have an action plan to generate a gif, but I still don’t know how to cleanly do that from within a plugin. (Hacking .htaccess files doesn’t attract me.)

EmailShroud 1.0.1 has now been tested against WordPress 2.0.1; it works without modification.

Updated page with reference to Enkoder. Thanks to Alastair.

I’ve had hard time downloading it today. Not sure if it’s my web connection…

J.

Jason,

The download is working fine for me. Please try again.

Business Blog Consulting points out that EmailShroud can’t be used for email addresses hard-coded within your theme files.

I’ll give that some thought in the next version (which remains an unplanned future hope at this stage.)

Under the section on limitations of EmailShroud, I wrote that it doesn’t handle:

Multiple email addresses within a single anchor tag, including ‘cc’ and ‘bcc’ addresses.

Here are two specific examples that aren’t handled:

• Having an anchor tag with a title field that contains an email address: <a href=”email address” title=”email address“>Contact Me</a>
• Putting the email address as both the text of the anchor tag and the href field: <a href=”email address” >email address</a>

I’ve been trying EmailShroud out and have a question: I’d like to link to my email address, with the linked text also being my email address (for example a. Whilst EmailShroud breaks up and ‘enshrouds’ the hyperlink reference, it doesn’t seem to do anything to do the linked text, which seems to appears normally in the source of the webpage. Given that, can this be safe?

Alan,

Thanks for trying EmailShroud out.

You are absolutely right; putting the email address in the same tag twice will fool EmailShroud, and leave your email address in plain text.

While I knew that this was a theoretical limit of EmailShroud from the beginning, I only saw this limit actually affect someone for the first time about a week ago.

I documented as a limitation in the original description, but last week I added a comment above clarifying this warning.

Originally, I didn’t think this was a serious limitation, but you are the second person to encounter this – so it is clearly a real issue. I will need to give some thought to how the plugin can be modified to handle this.

In the meantime, I recommend you avoid creating such links in your HTML. Leave the email address in the href tag, but remove it from the link text and title field.

Thanks for your feedback.

I’m going to use EmailShroud for a club blog, but I’d be interested in having it just strip out email addresses, and not display them even if spammers did have JavaScript enabled. This would respect people’s email address privacy, and the blog has a contact form that interested persons can use anyway.

Any tips for modifying the script to disable the part where it writes in the JavaScript, and just displays a mangled email address (something like the way Yahoo! does it would work, where the domain is replaced with “…”).

I’m not sure I understand. I have installed the plugin. I still see the mailto: in links of all email addresses and the @ sign. When I mouseover an email link the same above shows.

Jeffrey,

I have checked out your site, and I agree – there is no sign that EmailShroud is working.

Have you remembered to activate the EmailShroud plugin? That would appear to be the most likely cause.

If that is not it, then could you please provide a list of the other WordPress plugins that you are using? Perhaps there is a previously unknown incompatibiity there.

I notice that (a) you are required to register to leave comments on your site and (b) one of your plugins displays the email addresses of your registered users. Even if EmailShroud was working, I suspect you will find that this is an unpopular combination. I was a bit shocked to see my email address displayed to your readers; I changed my profile to put a dud email address in its place.

One final clarification: If EmailShroud is working (and your browser supports JavaScript) then mousing-over (mouse-overing?) a shrouded email link will display the email address as normal. It works transparently to the reader, but not to the spammer.

Mortaine,

It shouldn’t be too hard to modify EmailShroud to do that.

Once you get past the regular expression line-noise and the infrastructure required to make a WordPress plugin work, there is less than 50 lines of code there.

In the function sto_emailShroud_matchedEmailAddress there is a variable called result which is progressively filled with the HTML that is substituted for the email address. You will want to remove the Javascript that is added here. You will also want to replace the pieces of code that insert the domain name, which is found in $matchingText[2].$matchingText[5]. (That’s actually two places, but at all times exactly one of the two will be empty; which one depends on the matched pattern.)

Please let me know if you are successful.

If other people need this too, please comment here and I will consider it for a future release.

Hi Julian,
Thanks for your response. I have modified the members page to not show email addresses. And I thought I had it set for anyone to comment,, I fixed that as well.
As for EmailShroud, it is activated. I am playing with a few plugins as well as some widgets. I believe as you that there seems to be some incompatability because the Admin page in WP no longer shows the default info that usually comes up on the dashboard.

I’ll look a little further into it.

Hello,

Thank you for your effort in making this plugin. However, though it sounds like a good idea, looking at the internals of the implementation appears to be rather disappointingly vulnerable to spam harvesting.

Unlike some other email obfuscators, like the Hiveware Enkoder or Paul Gregg’s URL/Link/Mailto: encoder, Email Shroud leaves the email in plain text in the HTML source.

All a spammer has to do is look in the HTML source for “sto_user” and “sto_dom”, and they’ve got your email address in plain text. Here’s how “test @ example.com” looks in the HTML source:


sto_dom='example.com'
sto_user='test'


So that’s all a spammer has to search for and harvest.

In contrast, here’s how "test @ example.com" looks using Paul Gregg’s URL/Link/Mailto: encoder (minux the javascript tags, for readability):


eval(unescape('%76%61%72%20%73%3D%27%61%6D%6C%69%6F%74%74%3A%73%65%40%74
%78%65%6D%61%6C%70%2E%65%6F%63%6D%27%3B%76%61%72%20%72%3D%27%27%3B%66%6F
%72%28%76%61%72%20%69%3D%30%3B%69%3C%73%2E%6C%65%6E%67%74%68%3B%69%2B%2B
%2C%69%2B%2B%29%7B%72%3D%72%2B%73%2E%73%75%62%73%74%72%69%6E%67%28%69%2B
%31%2C%69%2B%32%29%2B%73%2E%73%75%62%73%74%72%69%6E%67%28%69%2C%69%2B%31
%29%7D%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%27%3C%61%20%68%72%65
%66%3D%22%27%2B%72%2B%27%22%3E%74%65%73%74%40%65%78%61%6D%70%6C%65%2E%63
%6F%6D%3C%2F%61%3E%27%29%3B'))


And in the Hiveware Enkoder it looks like this:


[CDATA[ */
function hivelogic_enkoder(){var kode=
"kode=\";)'':)1-htgnel.edok(tArahc.edok?htgnel.edok;\\\\\\\\\\\\\\\\\\\"\\\\\\\\\\\\\\\\\\\\\\\\\\\\"+
"='\\\\\\\\fxr'i;0oi(k=d;. */


Sorry to be so critical, but I think it would be great if this plugin could be improved to more seriously obfuscate email addresses, and the first step towards that is to point out its weaknesses. Maybe the Hiveware or Paul Gregg’s obfuscators can provide some inspiration.

Best of luck.

Dear Anonymous (aaa),

Thanks for your comments. I appreciate that it is important with any software related to security to have people taking a critical look at how it works.

The points that you raise have already been covered above, but let me address them again for clarity.

First, I would warn you that the first example of obfuscation by using escape codes – you use Paul Gregg’s obfuscator as an an example, but this is one of many – looks very secure at a glance, but is actually relatively lightly encoded. Because the technique used to encode it is (a) simple and (b) common, I would actually expect it to be cracked by spammers ahead of EmailShroud. (That said, it is far better than nothing!)

On the other hand, the second Enkoder example seems to be stronger, and I applaud it – I have had it as a reference in the Further Reading section for some months, so it has already provided some inspiration.

As I wrote in the comments above, I did consider the issue that spammers could spend effort to crack EmailShroud:

If EmailShroud became insanely popular, it might start to become worthwhile for a spammer to automate the detection of EmailShroud and decode the addresses.

I did start out with some ambitious plans to encrypt the email address with a randomised secret key to make this even more secure, but I realised I was kidding myself. I will deal with the encumbent problems of overwhelming popularity when (and if) they occur. Until then, the simple obfuscation should be more than sufficient. It’ll also load faster than a full solution.

When the proportion of WordPress blogs that use EmailShroud rises above, say, 0.5%, come right back here for a slower, more secure solution!

While the popularity of EmailShroud has been personally satisfying to me, I don’t think I am close to approaching that sort of level!

I should point out that Enkoder has been ported to PHP and made available as a wordpress plugin.

I get the plugin to work, but the e-mail addresses disappears in Firefox with JavaScript turned ON. Is this a known bug?

Anders,

This isn’t a known bug. I just retested it with the latest version of Firefox on Windows, and I am not seeing anything unexpected. I’ve not heard any other complaints from Firefox users either.

Perhaps you could email me more details of the problem (OS, software versions, steps you took) and/or a screenshot of the problem.

Please ensure the Status Bar is turned on (under the View | Status Bar menu.)

Thanks,

Julian

Following up from his previous comment, Anders kindly emailed me the details of his web-site, and I was able to confirm that, yes, there is a bug in EmailShroud 1.0.1.

It appears to be limited to pages being served as strict XHTML – that is the DOCTYPE at the beginning of the web page source is for XHTML 1.0 Strict. It also doesn’t affect Internet Explorer, but does affect Firefox and Opera when JavaScript is turned on

I have a fair idea of the cause, but I haven’t got a clear solution for it yet, and I don’t expect to get a chance to implement a solution for a few months.

In the meantime, if you are bold enough to go for strict XHTML compliance, I apologise and recommend you don’t use EmailShroud 1.0.1.

You can check for yourself what your blog’s theme uses by doing a View Source on one of your blog pages, and looking for the text “XHTML 1.0 Strict” hidden in the DOCTYPE line at the very top. Most people will see the word “Transitional” hidden inside it instead; those people should be fine.

Do you know of a similar plugin for Typepad?

…Paul Gregg’s obfuscator as an an example, but this is one of many – looks very secure at a glance, but is actually relatively lightly encoded. Because the technique used to encode it is (a) simple and (b) common, I would actually expect it to be cracked by spammers ahead of EmailShroud.

Thanks for the references, however Julian, I would like to counter your assertion about my encoding method. If you decode the javascript you would see that it is not trivial to decode back to the actual email address or link.

For example, I encoded the web address of this page using my routine which produces the following code:
eval(unescape(‘%76%61%72%20%73%3D%27%74%68%70%74%2F%3A%77%2F%77%77%73
%2E%6D%6F%74%65%69%68%6B%6E%64%6F%2E%64%6F%63%2F%6D%64%6F%74%64%69%68
%6B%6E%6E%69%2F%67%6D%65%69%61%73%6C%72%68%75%6F%2D%64%6F%77%64%72%72
%70%73%65%2D%73%6C%70%67%75%6E%69%2F%27%3B%76%61%72%20%72%3D%27%27%3B
%66%6F%72%28%76%61%72%20%69%3D%30%3B%69%3C%73%2E%6C%65%6E%67%74%68%3B
%69%2B%2B%2C%69%2B%2B%29%7B%72%3D%72%2B%73%2E%73%75%62%73%74%72%69%6E
%67%28%69%2B%31%2C%69%2B%32%29%2B%73%2E%73%75%62%73%74%72%69%6E%67%28
%69%2C%69%2B%31%29%7D%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%27
%3C%61%20%68%72%65%66%3D%22%27%2B%72%2B%27%22%3E%6C%69%6E%6B%20%74%6F
%20%65%6D%61%69%6C%20%6F%72%20%75%72%6C%3C%2F%61%3E%27%29%3B’))

However, if you actually decode that you will see:
var s=’thpt/:w/wws.moteihkndo.doc/mdotdihknni/gmeiaslrhuo-dowdrrpse-slpgu
ni/’;var r=”;for(var i=0;ilink to email or url’);

I hope you would agree that it certainly wouldn’t be cracked quite as easily as you suggested previously.

Regards,

PG

I would like to sincerely apologise to Paul Gregg for wrongly maligning his code.

I overlooked the “eval” call in the decoder, and thought it was just unescaping the text.

The original anonymous poster (aaa) was absolutely correct that Paul Gregg’s obfuscation is more powerful than the one in EmailShroud.

I am very sorry, Paul. Thank you for correcting me.

This might be a opportunity to hint that I have been spending some time on EmailShroud 2.0. In response to requests here, increasing the obfuscation level is on the list of priorities [whether I think it is overkill or not :-)]