Fixes #68 - Implemented address masking script

pages/address-masking.md

Index: pages/address-masking.md
===================================================================
new file mode 100644
--- /dev/null
+++ b/pages/address-masking.md
@@ -0,0 +1,32 @@
+title=Address Masking
+description=Use address masking to avoid spam.
+
+# Address masking
+
+Use address masking to avoid spam.
+
+## Usage
+
+```
+// 1. Base64 encoded sensitive address

[ire, 2018/05/07 23:02:23]

NIT: Why not separate the code blocks so the titles/steps can be outside the
block. e.g.

### 1. Base64 encoded sensitive address

```
btoa("mailto:username@example.com")
```

### 2. Place encoded address inside `data-address`

...

[juliandoucette, 2018/05/07 23:51:39]

Done.

+
+btoa("mailto:username@example.com")
+
+// 2. Place encoded address inside `data-address`
+
+<a data-address="bWFpbHRvOnVzZXJuYW1lQGV4YW1wbGUuY29t">Private Email</a>
+
+// 3. Include `static/js/address-masking.js`
+
+<script src="static/js/address-masking.js"></script>
+
+// 4. See `data-address` decoded into `href` appropriately
+
+<a href="mailto:username@example.com">Private Email</a>
+```
+
+## Example
+
+<script src="/js/address-masking.js"></script>
+
+<a data-address="bWFpbHRvOnVzZXJuYW1lQGV4YW1wbGUuY29t">Private Email</a>

[ire, 2018/05/07 23:02:23]

What about when there is no JS? This makes the link unusable :( 

[juliandoucette, 2018/05/07 23:51:39]

Yep :( ... I don't see a Frontend way around that.

[ire, 2018/05/09 05:19:54]

Yeah, I'm not sure of a solution to this either. Can you check with legal that
we can do this? Because this will make the email inaccessible to some percentage
of users and that may not be an option. 

[juliandoucette, 2018/05/15 09:53:36]

<julian> judith: Is it a problem if our phone numbers and email addresses are
inaccessible to dumb robots and web browsers with JavaScript disabled? (for the
sake of spam protection) (e.g. on the privacy policy page)

<@judith> julian: for dumb robots defintely no problem at all. In terms of
JavaScript disabled: how likely is that from your experience?

<julian> judith: very very unlikely. JavaScript is enabled by default and most
of the web doesn't work without it. There are two good reasons to disable
JavaScript that I know of. 1. To test a worst case scenario in a website or
webapp. 2. To protect your privacy. Most people protect their privacy using
extensions like ours (that block known trackers) or privacy badger (which uses
some additional privacy protecting heuristics). Those who take their privacy
more seriously use extensions like NoScript which selectively blocks JavaScript
using heuristics and explicitly asks for permission to run scripts and/or parts
of scripts. Disabling JavaScript completely is usually an advanced setting. The
only browser that I know of that places this setting in the forefront is the Tor
Browser.

<@judith> julian: ok, great. Thanks for the background info. Thus, no issue with
javascript disabled either

<julian> judith: 👍🏻 Thanks!

<@judith> julian: thank you

[ire, 2018/05/15 15:12:07]

A reason for no-js you didn't mention was performance, e.g. people using
browsers like Opera Mini. However, based on our browser stats that may not be a
significant enough portion of our users to think about. Which begs the question,
why do we support no-js in our websites at all?