2

I am working on a searchable online directory. People will use it to find other members, service providers, and the like. It's critical that the results include contact data. However, my clients are very concerned about data harvesting/poaching by marketers, competitors, spammers, and others.

We have toyed with the following ideas to prevent someone from grabbing a lot of contact data at once:

  • Do not present contact information in a results list; users must drill in for details.
  • Limit the # of searches per minute/hour/day; block offending IP addresses for a period of time.
  • Limit the # of results the user can bring back at one time. (We believe it is more likely that users would try a new search vs. scrolling many pages, anyway).
  • Encrypt customer IDs in the URL so scripts cannot be executed that test IDs/load their details.
  • Render contact information with spaces so it can be visually understood but if copied, requires some manual cleanup. (I don't like this idea, esp. for accessibility).
  • Provide a "contact" action that leverages a member's email address without displaying it outright.

We will probably try a few of these but I would love to know if there is a best practice for this sort of security.

Thank you!

Improve this question
1

Either the intent is for the information to be accessible to the general public, or not.

If the goal is for contact information to be accessible to the public, spam is simply a part of life. Any public-facing organization with a web presence deals with this. It is just the cost of having your information out there. If you wish the contact list to be publicly available, your contacts will just have to decide whether they are willing to bear this cost.

On the other hand, if you want the audience to be more limited, you need a real system to limit the audience. This means user accounts and all of the management that comes with them.

The possibilities you mention are half-measures that are unlikely to accomplish much other than annoying legitimate users of the system.

Improve this answer
3
  • Agree. None of the ideas will keep anybody that values the data from getting it. Regarding the 'Encrypt customer IDs in the URL...' You should not put anything in the URL that has any tie to authentication or contact information anyway. Regardless of your scheme for keeping unwanted visitors away from the contact data, do not put a customer ID in the url. (You probably know that but including it in the list suggests the ID might appear in the URL.)
    – user1757436
    Oct 30 '14 at 17:28
  • I believe our developers were planning to encrypt IDs but I threw it in there anyway, so I had a complete list of strategies. Thank you for your response!
    – Nancy_Mc
    Nov 3 '14 at 15:24
  • Re. who will be accessing these directories, we provide software to clients that make the "who" decisions. Sometimes the directory is behind a login (e.g. members-only), sometimes it is not. We want to make sure we're doing what we can to make it annoying not for end users, but for potential spammers. Thanks for the feedback!
    – Nancy_Mc
    Nov 3 '14 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.