Do we still need to spamtrap email addresses on the web?

I hate spam.

So far, so uncontroversial. Most people hate spam, apart from the people that make money from sending it.

While spam can cause a fair amount of inconvenience for individuals that receive it (ie. anyone with an email address), it’s a major headache for sysadmins and ISPs.

Yet, for all this, since my move to Gmail a couple of years ago spam has been a lot less of an issue for me. 99% gets filtered to my Spam folder and the tiny number of spams that get through aren’t enough to cause me a headache when I summarily delete them.

Until recently, I’ve always taken a very cautious approach towards revealing people’s email addresses on websites where spambots might harvest them. At a minimum, this means using the familiar obfuscation techniques, such as firstname dot lastname at domain dot com, hex encoding the address or rendering an email link with JavaScript. More often, I’ll use a contact form and not display the address visibly at all.

As with all security measures, protecting email addresses requires the designer to find the right balance between making it easy enough for people to do the legitimate things they want to do (contact you) while making it sufficiently difficult for people to do unwanted things (harvest your address and spam it mercilessly).

Clearly, the only way to avoid harvested spam is to not disclose your address publicly at all. Even then, there are other ways that spammers might get you.

With reliable filtering in the mail client, it seems reasonable now to relax spam protection techniques on web pages. Spam does not cause users the problems it once did. This applies to a wide variety of systems, whether filtering in the client like Gmail does, or on the server with Bayesian filters like SpamAssassin.

Why make users spend their time reassembling an address from its fragments with real dots and an at-sign? Why depend on JavaScript to hide an address, which will cause accessibility problems for some users, not to mention stopping legitimate spiders indexing that content? Why force people to use a contact form which will provide unfamiliar and possibly weird usability (tiny box to type in, full postal address and valid postcode required!) when they can just use their own email client and have the message stored where they want it, in their Sent folder?

While client filtering remains anything less than 100%, spam will still be sent, most probably now in increased numbers to compensate for the fewer messages actually getting delivered and read. That’s hard work for sysadmins and ISPs. But where spam now tends to trouble end users little, is it now time to return to unobfuscated mailto links and visible email addresses, give users a break from contact form misery and let the professionals do the rest?