{"id":294,"date":"2006-09-15T00:18:30","date_gmt":"2006-09-14T13:18:30","guid":{"rendered":"http:\/\/www.somethinkodd.com\/oddthinking\/emailshroud-20\/emailshroud-advanced-settings\/"},"modified":"2006-09-15T00:18:30","modified_gmt":"2006-09-14T13:18:30","slug":"emailshroud-advanced-settings","status":"publish","type":"page","link":"https:\/\/www.somethinkodd.com\/oddthinking\/emailshroud-wordpress-plugin\/emailshroud-advanced-settings\/","title":{"rendered":"Advanced Settings"},"content":{"rendered":"

<\/a>Advanced Settings for EmailShroud<\/h3>\n

Dealing without JavaScript.<\/h4>\n

For users with JavaScript, EmailShroud appears transparent \u00e2\u20ac\u201c they won\u00e2\u20ac\u2122t even notice it is there.<\/p>\n

However, a small minority of people use browsers which do not support JavaScript \u00e2\u20ac\u201c often this is for reasons of extra security. For these users, EmailShroud is noticeable. There are two ways that EmailShroud can handle these cases known as \u00e2\u20ac\u0153Action Plans\u00e2\u20ac\u009d<\/p>\n

Divert to default decoder page on EmailShroud site.<\/h5>\n

The default behaviour is to replace the email address with a link to a decoder web-page on SomethinkOdd.com. This web-page decodes the obfuscated email address and displays it, but the user must type it in manually to their email program.<\/p>\n

Note: This default behaviour diverts the user to a 3rd party web-site \u00e2\u20ac\u201c i.e. this one. <\/em>In the unlikely case that the amount of CPU and bandwidth used by this service becomes non-trivial, I reserve the right to add (tasteful) adverts to the page that they see. I understand that may be unacceptable to some people, and I offer them an alternative action plan \u00e2\u20ac\u201c see below.<\/p>\n

Transform Address<\/h5>\n

An alternative action plan is to include the email address in the text, after being transformed in some way so it is no longer recognizable as an email address (e.g. including some garbage in the email address, with instructions to the reader to remove it.)<\/p>\n

You can use the default transformation, or change the parameters to produce your own. I encourage you to produce your own to (a) localize the text to your blog\u00e2\u20ac\u2122s language or style, and (b) to prevent spammers from writing code to overcome this technique.<\/p>\n

The transformation occurs in three parts:<\/p>\n

    \n
  • a prefix, placed before the address.<\/li>\n
  • a replacement for the @ symbol.<\/li>\n
  • a suffix, placed after the address.<\/li>\n<\/ul>\n

    This allows popular transformations like:<\/p>\n

      \n
    • replace the \u00e2\u20ac\u0153@\u00e2\u20ac\u009d with \u00e2\u20ac\u0153@NOSPAM.\u00e2\u20ac\u009d Or \u00e2\u20ac\u0153@REMOVEME\u00e2\u20ac\u009d<\/li>\n
    • replace the \u00e2\u20ac\u0153@\u00e2\u20ac\u009d with \u00e2\u20ac\u0153 AT \u00e2\u20ac\u0153.<\/li>\n
    • Optionally, add some text to explain to people how to modify the address.<\/li>\n<\/ul>\n

      Security Settings<\/h4>\n

      EmailShroud works by obfuscating the email address. In theory, this won’t stop a motivated hacker from extracting the email address – all the information is available to decrypt the email address. In practice, it doesn’t take much to obscure the email address to a level that a spammer won’t bother, and will move on to another web-site to harvest someone else’s address.<\/p>\n

      EmailShroud offers three levels of obfuscation so you can tradeoff between the level of security and the cost of decoding.<\/p>\n

      Rearrangement<\/h5>\n

      Rearrangement is a very simple system and takes negligible computation to encode and decode. It was the only solution available in EmailShroud 1.0. While I maintain that rearrangement is currently sufficient obfuscation, critics of EmailShroud 1.0 considered it insufficient, which is why EmailShroud now offers three levels.<\/p>\n

      Reverse\/Shuffle<\/h5>\n

      Reverse\/Shuffle is a still a simple system, and takes very little computation to encode and decode. Its advantage over Rearrangement is that it cannot be decoded with a trivial “regular expression” engine.<\/p>\n

      Triple DES (3DES)<\/h5>\n

      3DES uses standard industry-standard encryption techniques. It is computationally it is fairly expensive, to encode and decode. It should discourage the efforts of even the stubbornest spammer!<\/p>\n

      On a page with many email addresses, you may notice a delay in loading while the computation is performed.<\/p>\n

      The 3DES security level has been provided to silence any remaining critics of the obfuscation levels available. In my opinion it is overkill, and is not recommended.<\/div>\n

      Note: 3DES cannot be turned on while redirecting non-Javascript users to the EmailShroud site. This is for three reasons:<\/p>\n

        \n
      • The EmailShroud site remains the weakest link in the obfuscation. The spammers could merely follow the link to the EmailShroud site, and let it do the decrypting, then harvest the lightly obfuscated address from the page. If you want this level of obfuscation, you should use your own, novel, transformation strings.<\/li>\n
      • It is computationally too expensive; if EmailShroud became too popular, my server would spend its entire day decrypting email addresses.<\/li>\n
      • I had a stab at implementing it anyway, but it was very buggy and I got bored. \ud83d\ude42<\/li>\n<\/ul>\n

        How to Set and Debug the Options<\/h4>\n
          \n
        1. Open the Options Panel\n
            \n
          1. Login to your WordPress Admin site.<\/li>\n
          2. Select the Options page.<\/li>\n
          3. Click on the EmailShroud tab.<\/li>\n<\/ol>\n<\/li>\n
          4. Select the Desired Action Plan.<\/li>\n
              \n
            • If you chose Transform, you can select the desired transformation parameters.\n\t<\/li>\n
            • Tip: Take care with leading and trailing spaces.<\/li>\n<\/ul>\n
            • Select the desired Security Level.<\/li>\n
            • Select Update Options, and check for warnings.<\/li>\n
            • Test your settings by turning off JavaScript in your browser, and clicking on an email address.<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

              Advanced Settings for EmailShroud Dealing without JavaScript. For users with JavaScript, EmailShroud appears transparent \u00e2\u20ac\u201c they won\u00e2\u20ac\u2122t even notice it is there. However, a small minority of people use browsers which do not support JavaScript \u00e2\u20ac\u201c often this is for reasons of extra security. For these users, EmailShroud is noticeable. There are two ways that […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":292,"menu_order":20,"comment_status":"open","ping_status":"open","template":"","meta":{"_s2mail":"","footnotes":""},"class_list":["post-294","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/pages\/294","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/comments?post=294"}],"version-history":[{"count":0,"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/pages\/294\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/pages\/292"}],"wp:attachment":[{"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/media?parent=294"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}