4 ms·

It's actually not that hard, assuming you control your form generation. Bots usually fill in fields using the actual field name - not the label the user sees. S

It's actually not that hard, assuming you control your form generation. Bots usually fill in fields using the actual field name - not the label the user sees. So provide a field labelled "Age" but named "email", and simply check it contains digits. If it's got an email address in it, it's a bot. Labels can also be obfuscated with javascript, replacing the raw HTML "Email" with "Age"on page load. Getting this right will require the bot to parse both HTML and JS, and we can force them to handle CSS too. Add a "zip" field, and hide it with complex CSS rules. If it contains a zip code, it's a bot. If you're really paranoid, randomise combinations of distinguishable fields (name, email, phone, age and hidden fields) every time you generate the form, so even if a bot herder manually maps names to fields one time, it'll fail the next. At this stage it'll be cheaper for the bot herder to use Mechanical Turk, after which even Google's captcha is compromised.

jtolmar 8y ago
This is very hostile to people who use screen readers.
- darkpuma 8y ago
  I've found that the tech industry often is. Trying to get managers to set aside time to iron out accessibility issues is like pulling teeth. Trying to get other developers to take it seriously is almost as bad. Often you count yourself lucky if the bare legal minimum is implemented. Accessibility is very important, and if accessibility features are implemented well they'll often be useful even to people without disabilities, but do any CS/SE or code bootcamp programs take the topic seriously? I'm sure it must be taught somewhere, but it doesn't seem to be common at all. Can you even imagine 21st century university architecture department that didn't cover ADA compliance? That'd be unthinkable.
  - cesarb 8y ago
    > Can you even imagine 21st century university architecture department that didn't cover ADA compliance? That'd be unthinkable. I can easily imagine it: architecture departments from universities in other countries don't necessarily have to cover compliance with USA laws.
miki123211 8y ago
>So provide a field labelled "Age" but named "email", and simply check it contains digits. If it's got an email address in it, it's a bot. Or a blind user who might actually rely on both labels and names. That's a bit like what arxiv does, they have hidden links that ban your ip when you crawl, but the links aren't hidden for AT users. I got myself banned that way once.

jtolmar 8y ago

This is very hostile to people who use screen readers.

darkpuma 8y ago
I've found that the tech industry often is. Trying to get managers to set aside time to iron out accessibility issues is like pulling teeth. Trying to get other developers to take it seriously is almost as bad. Often you count yourself lucky if the bare legal minimum is implemented. Accessibility is very important, and if accessibility features are implemented well they'll often be useful even to people without disabilities, but do any CS/SE or code bootcamp programs take the topic seriously? I'm sure it must be taught somewhere, but it doesn't seem to be common at all. Can you even imagine 21st century university architecture department that didn't cover ADA compliance? That'd be unthinkable.
- cesarb 8y ago
  > Can you even imagine 21st century university architecture department that didn't cover ADA compliance? That'd be unthinkable. I can easily imagine it: architecture departments from universities in other countries don't necessarily have to cover compliance with USA laws.

miki123211 8y ago

>So provide a field labelled "Age" but named "email", and simply check it contains digits. If it's got an email address in it, it's a bot. Or a blind user who might actually rely on both labels and names. That's a bit like what arxiv does, they have hidden links that ban your ip when you crawl, but the links aren't hidden for AT users. I got myself banned that way once.