I have a web application where users register and are activated via an email sent to the email address they supplied.

Then there are pages that are only visible to registered users (non-user access is restricted by checking for a User Object in the session).

On these restricted pages I would like to display a listing that includes the email addresses of other users.

Do I still need to take precautions to obfuscate the email addresses so that they are protected from spam bots and the like? Or is it enough that the page isn't accessible to non-authenticated users?

Edit: The emails on my site are not particularly valuable and it is not a site with very sensitive material. I just don't want the users to be bothered with spam.

  • Are the other users expecting that their email addresses will be provided to other members? – GrandmasterB Oct 7 '15 at 17:44
  • Yes. They are told that their details will be displayed... – theyuv Oct 7 '15 at 17:46
  • How difficult is it to register? What would keep a spammer from registering an account? – thorsten müller Oct 7 '15 at 17:54
  • 1
    You may want to ask over on Security.SE, those guys should be able to give good advice on whether email registration is enough to deter bots in your case, and what alternatives there are if you need to both show emails and protect privacy. – Ordous Oct 7 '15 at 18:22
  • 3
    email is not enough to deter spambots. If it was, no registration form would ever contain a captcha. If you want to avoid spambots, you need some kind of captcha. – Mike Nakis Oct 7 '15 at 18:50

When handling user data, especially in a format where it will subsequently be visible to others, you are better off taking more precautions against spam. Spambots are getting better and better at harvesting data, and if they identify an easy way to access such data via your site, you're likely to become a target.

Not only is this bad for your users but it's also bad for your site, as frequent bot traffic can put a load on your servers and slow the site down.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.