On Saturday, December 7, 2002, Eric Smith wrote:
>>> The way I had thunk it, it would need to be both unique and
>>> reversable.
>>
>> Nope, don't need to. When you add an email address to the database,
>> calculate the MD5 hash and store that with it. Make sure you've got
>> indices on the table for both the hash and the address. When some
>> user uses the form you get the hash back as an argument, form field,
>> whatever. Look it up in the table and you get the cleartext address.
>
> I think the point of his original proposal was to be able to implement
> this without a database, just a CGI script.
Right. No database.
The encryption need not be complex. A simple rotation or XOR scheme would be
sufficient. The idea is that it is not worth it to the spammer to figure out
the scheme used at this one little site, and it's something that
general-purpose harvesting heuristics aren't likely to notice.
Due to Sellam's and Eric's comments, my opinion has swung back in favor of
the 2-step process.
I do have to resist a "type in the what this picture says" human-detection
step, though. As I said earlier, this has to be doable in a text mode
browser. So I'll probably use something like "type in the sum of 67834 and
347", where the numbers vary with each email address.
--
Jeffrey Sharp
Received on Sat Dec 07 2002 - 16:45:01 GMT