Last week, I needed to get in touch with a colleague, an academic who'd recently changed universities; I didn't have his current email address, so I sent him a tweet: "Don't have your new email, can you drop me a line at doctorow@craphound.com?"
And yes, I did get in touch with my friend but I also got a flurry of emails and tweets from people who were shocked to their boots that I had [gasp] published my email address. I even got an automated email from a twitterbot directing me to a website advising me on all the horrible unsolicited email I could expect to get if I made my email address public (the irony of sending this advice in an unsolicited email was apparently lost on the bot's author).
But I've had a published email address for more than a decade. It's pretty much the only email address I use (more on this later), and yes, I get a lot of spam there. But I'm not convinced that keeping an email address secret is anything but a fool's errand.
The main reason to keep one's email address secret is to hide from the spambots – those nefarious snafflers of unguarded email addresses that act as input for all the unsolicited email that unscrupulous huxters and scammers firehose over our inboxes.
Like everyone, I have spam filters. I use three lines of defence: first, I have greylisting switched on for my mail server (this is a simple server configuration that sends a "busy, try again in 15 minutes" message the first time another mail server tries to communicate with it in a 24-hour period; this gets rid of over 90% of the 20,000-plus spams directed at me every day).
Second, I have the spam filter built into Thunderbird, the free/open mailer from the Mozilla people (the same people behind Firefox). Finally, I have a blacklist of terms and from-addresses for filtering out commercial offerings from firms who think that buying a single machine screw or teacup means you want to hear from them twice a week for the rest of time.
I don't really care how much spam gets eaten by my filters – all I care about is how much spam gets through; that is, how much spam I have to clear out by hand. If the server is culling 16,000 or 160,000 spams a day, it makes no difference to me. On the other hand, if the 100-300 spams I manually kill every day turned into 1,000-3,000, it would seriously undermine my productivity.
So I publish my email address, because I have yet to see any compelling evidence that hiding your email address or using silly techniques like spelling it out (doctorowATcraphoundDOTcom) is any proof against email harvesters. I can think of a way of detecting and converting such obfuscated email addresses, and if I can think of it, so can some spambot author, and she can write the code to do it.
I also have yet to see any compelling evidence that each additional publication of my email address accounts for any uptick in the amount of email that penetrates my filters. Surely after more than a decade, my email address is already in the databases of the world's greatest and most prolific spammers. Re-adding it doesn't make their spam any better at puncturing my defences.
Indeed, the main category of spam that makes it through the filter comes from PR people who have bought it as part of a list of journalists who they might pitch and who are hoping to get a product mentioned on Boing Boing. This is the hardest stuff to filter, since it comes from so many valid email addresses, each message containing unique body text that mentions me by name.
Every time I get one of these pitches, I add the agency's entire domain to my killfile (there's only one way to pitch me a Boing Boing story, and that's via the form that is prominently linked from every single Boing Boing page), but new agencies pop up like weeds. Lucky for me, PR people are exceptionally poorly co-ordinated and that makes it easy to catch the spams from the subject line alone – two or three emails with the same subject line received within a few moments of each other can be shift-click selected and deleted in an instant. I also get a small but steady stream of nutjob email – this is easier to filter, since the crazies usually use a stable address that's easy to add to a killfile.
Meanwhile, obfuscating email addresses costs something: it costs me the time it takes to arse around with trying to come up with a bot-proof, human-readable encoding of my address, and it costs my correspondents whatever time they spend unscrambling my system.
The only way I know of to avoid the spam-flood is to change email addresses frequently, thus sacrificing all the value that comes from having a long-term, stable email – easy password recovery (trying to recover a password from a service that you signed up to from a dead email address is a lost cause); a stable place for business correspondents (people who want to license my writing can use the email address that appears on it and it will reach me); a continuous way to correspond with friends and loved ones.
Almost any email address that you use for any length of time eventually becomes widely enough known that you should assume all the spammers have it. So either you sacrifice stable communications, or learn to tolerate a certain baseline of spam.
I do have a few "secret" email addresses, but these are extremely special-purpose. For example, I sometimes create short-term secret throwaway Gmail accounts that a few trusted people have access to while I'm on an email-free holiday. I also have a secret Gmail account that my Android phone is connected to – I email myself grocery lists and other ephemera as a cheap-and-easy way of getting that stuff onto my phone. I also have a secret account that is connected up to a shared Google Calendar that my travel co-ordinator uses to store my itineraries; this synchs automatically to my phone and my wife's desktop. These secret account names are created by using a password generator to come up with a random string, such as "B6CD8C3112B51B4317FC8F1C0A1F3D85274C1E860CCC5F5D76F294529F5D8128@gmail.com" (I like the password generator at grc.com/passwords.htm for this). It's vanishingly unlikely that a spammer will hit on this by brute force – but if the address does leak, it's easy enough to fix, since only a few people or devices use it. It's a measure that fails gracefully.
I know a lot of people who swear by Google's own spam filters, but I'm privacy conscious enough that I'm loathe to give my whole email corpus to Google (though I correspond with so many Gmail users that Google already has a significant fraction of my email output in its servers).
In any event, the Thunderbird filters work well for me, especially in combination with a nice trick I picked up along the way: every time I send an email, Thunderbird is set to add the addressee to my address-book, which becomes a database of known correspondents. Every time a new email arrives, it is sorted based on whether it appears in that database (that means I can easily prioritise email from people I know). I also have Thunderbird colour all known-sender email green, and so I can quickly check the spam folder for green messages before clearing it out as a way of catching false positives.
The spam wars aren't going away any time soon, and yesterday's tactics might not work against tomorrow's spammers. Nevertheless, I can't imagine a future in which treating our public email addresses as secret will do any more good than tossing spilled salt over your shoulder. Meantime, the convenience of stable, easily copy-pastable email addresses is such that I plan on using doctorow@craphound.com for a long, long time to come.