[laurihy]

Thanks! :)

As many have asked, at least for now there's no real spam protection. Asking you to confirm email for every email/referer pair prevents me from adding your email to zillion sites (although confirmations could also get annoying at that point :) and spamming, but of course that doesn't still prevent bots from filling out your form.

I think in a way it's a tradeoff between ease of use, both for you and the visitor. Alternatively we could do heavier registration process and/or let you configure some running on our server, but then setting things up wouldn't be as easy and you might as well just run your own backend. For the visitors forms provide an easy (than, say just email) way to reach out. I guess the question is, do you prefer false positives (spam) or false negatives (folks not reaching out) :)

Regarding having clear text emails in the source, I'd argue (based on nothing but anecdotes) it doesn't matter, much. As throwawaymsft said elsewhere, bots are pretty good at figuring out what "you (at) email (dot) com" means, so in most cases you'd anyway be getting much spam. We considered a token-based approach instead, but decided to go all-in for simplicity. Also, since we're using forms anyway, they're more likely source of spam than some bot crawling just for addresses.

[maouida]

great idea.

I think you can give the user the option to specify the email hash (MD5 maybe) instead of clear text email.

so either:

<form action="//api.formspree.com/[e-mail]">

OR

<form action="//api.formspree.com/b58996c504c5638798eb6b511e6f49af">

You can provide the user a small tool to generate the email hash.

Good luck

[jodrellblank]

Gravatar uses MD5(email) as an identifier, so using that would potentially identify the recipient quite easily.

[joshmlewis]

But it's good enough that an auto scraper or spam bot will find it easily.

[maouida]

The recipient can be identified by email or md5(email).

[icebraining]

But then how can they know where to send the email to?

[maouida]

They have the email (confirmed email) in their DB. they can easily calculate the hash on the fly.

[cbhl]

I'd use base64 instead of a MD5 hash, but I'm not a huge fan of security by obscurity.

[Scryptonite]

This might also work:

    <form action="//api.formspree.com/user.smith/gmail.com">

Truthfully, base64 is probably better at deterring email harvesters.