RC4 email

This module provides graceful email obfuscation to protect email addresses from harvesting bots on mailto links generated by the Drupal l() function by obfuscating email addresses found in mailto links and its link text. A RC4 ciphertext of the original email address are saved and is later decrypted and reinserted back to HTML by Javascript, providing a transparent experience to sites where a majority of users are using a Javascript-enabled browser, at the same time prevents non-Javascript capable bots (which at the time of writing, are the majority of the bots out there) from harvesting email addresses.

We make good use of the RC4 stream cipher for saving and restoring plain text email addresses, hence "RC4 email".

Example

Original:

<a href="mailto:example.one@example.org">Send email to example.one@example.com</a>

Obfuscated for bots:

<a href="mailto:example ! one () example ! org" data-emailurl="H5NkTqSWw54048Y34paoxxdCTz5/yAKUavP6XcL7ZeB24tB4" data-textenc="MYBsVbaWi5lm1dQz4IW/nQVV" class="rc4_email">Send email to example ! one () example ! org</a>.

While look and work exactly the same as the original for your average users.

Demo

A demo site has been set up, to see what actually is going on do make use of view source feature of your browser as Javascript will decrypt the original email and updates the DOM tree:

http://rc4_email.sunnz.net/

Also take the driver's seat by looking at the configuration options (admin/config/content/rc4_email) by firing up an Drupal instance with RC4 email module at simplytest.me:

http://simplytest.me/project/rc4_email

Features

We strive to make this module to satisify the requirements listed in http://alistapart.com/article/gracefulemailobfuscation as we like to adhere to the same requirements on our sites and client's sites too.

• "No hassle, please" (ALA) - users of the web site get real, clickable email links that work just as expected as long as they have Javascript turned on, and the links are immune to bots.
• "Graceful degradation" (ALA) - email addresses are obfuscated and are not removed from the link nor its link text, a non-Javascript enabled user can still make out the email address. We also planned to write alternative ways to provide an email address to a non-Javascript enabled user, for example, a non-Javascript CAPTCHA page.
• "Install and forget" (ALA) - installing this module in this default configuration will apply its email obfuscation to all mailto links generated by Drupal core's l() function. Use this module with a recommended filter described later on, and your whole site should be fairly safe from bots.
• Uses real cryptographic encryption RC4 instead of merely encoding a plain text version of the email address. Apart from the cool factor from using industrial strength encryption, we believe this gives us a very flexible framework to work with, as we end up with 2 separate design logic: obfuscating an email address for non-Javascript spambots and users, and encrypting/decrypting email address for Javascript-enabled users. This means we can easily change the way an email address is obfuscated without changing the code for encryption/decryption, and vice versa.
• Sane cryptographic practice - cryptographic key are randomly generated per page instance, refresh and the email addresses and encrypted to a completely different cipher-text.
• More configurable option in the plan!

Recommended modules

As this module only works with links generated by Drupal's l() function, you will need other modules that works with emails addresses that come from some other sources. We recommend installing one of the following filter modules in addition to RC4 email to obfuscate email addresses found in l() functions and text formats. Together they are a highly effective way for protecting email addresses from being harvested from your web sites.

• Invisimail
• SpamSpan filter

Requirements

Should work on any Drupal 7 installation as the module brings its own PHP and Javascript implementation of RC4.

Known problems

Fixed: This module strip tags in the link text regardless of HTML flag in l() $options array.

Road map

• Add uninstall hook to clean up configuration variables. Done.
• Filter link text html base of HTML flag. Done.
• Demo site. Done.
• Custom email obscuring method by specifying a regex for preg_replace(). Allow specifying multiple regex and have one picked at random or sequentially.
• Custom email matching regex. Done.
• Decrypt email onmousehover/onclick.
• Custom replacement link, allow choice of deleting the link, or specifying regex for preg_replace(). Provide default regex that turns an email into a site path, for example, name@example.org becomes contact/name/example/org, or simply pass mailto link to _rc4_email_obscure_emails().
• If replacing link to a site path, redirect to contact form, or redirect to a non-scripted CAPTCHA page that once passed, reveals the email address.
• simpletest
• 8.x-1.x

Module created by

• sunnz Sunny Yiu
• cyrus_bt5 Robert Gurtler