waving android

I am currently a software engineer at Google, where as a member of the Android platform team I build frameworks and user interfaces.

The blog here at is mostly historical; you can find more recent posts on .

New email spam.

February 8th, 2006

A new technique in foiling content-based spam filters: using CSS rendering to construct text that the filter can’t see.


V<span style="float: right"> b </span>I<span style="float: right"> d </span>A<span=20 style="float: right"> z ...

The “chaff” characters (b, d, z, …) float to the right, while the letters “VIA” in the above example (followed by “GRA” in the source material) settle to the left, lining up in order. Your spam filter’s tokenizer sees nothing.
(Previous version of this hack relying on HTML rendering to construct text that the filter can’t see. Example: V<!--foo-->I<!--foo-->A<!--foo-->G<!--foo-->R<!--foo-->A.)

newer: older: