8 ms·
For bots which are not specifically targeted at your page i simply add an invisible form element named url. Bots _LOVE_ to share their viagra urls. Any request
by tpetry 7y ago
For bots which are not specifically targeted at your page i simply add an invisible form element named url. Bots _LOVE_ to share their viagra urls. Any request which submitted an url is discarded.
This trick is simple stupid and should not work but somehow the simple spam bots have not improved.
This does not work for sophisticated bots (never met one) or the ones programmed specifically for your site (happens very rarely).
- enobrev 7y agoIt's been a couple years since I've implemented one of these, but I've used this method in various forms on projects for at least a decade. Sometimes I use a hidden "email" field. Sometimes a hidden "subject" field. Hadn't thought of a "url" field, which is a great idea. It works surprisingly well.
- willio58 7y agoThis is simple form of a honeypot but it is really ineffective. Any bot with even minimal sophistication will know to leave the hidden field empty.
- corobo 7y agoYou hide it with CSS, not type='hidden'
- dev_256 7y agoYou can still figure out it's hidden.
- IshKebab 7y agoSure but the point is that almost nobody does.
- SquareWheel 7y agoIt really doesn't matter. display:none or position:absolute;left:-1000px makes little difference. Honey pots only catch a small number of bots.
- corobo 7y agoI only have anecdata of course but so far I've had a 100% success rate. I imagine this will come down eventually but for the past ~year or so it's been working fine to just hide the honeypot field with CSS
- SquareWheel 7y agoI'm glad it's worked for one of us at least.
- corobo 7y agoI don't know if it helps any but I've been using a field that looks real. Depending on where it is the name= would be surname (where the form submission has a name field rather than a first name surname split), website, url, etc
- Lunatic666 7y agoI just removed Google's ReCaptcha for a honeypot solution with an additional name and url field. But there's also a timer which checks how long it takes you to submit the form. If you can fill out everything in <2s, you're most likely not human. I have to figure out how people with disabilities can use the page though. Good to get a reminder here. So far it performs way better than ReCaptcha, I haven't received any spam so far and plenty of ham of course. No human complaints either.
- SquareWheel 7y agoA timer is a novel idea. I hadn't seen that suggested before. Do you anticipate any problems with form auto-filling tools?
- mikojan 7y agoSo now you're filtering out bots and people with disabilities?
- vbezhenar 7y agoYou can set placeholder with something like "leave it empty".
- icebraining 7y agoNope, screen readers (usually?) ignore elements with "display: none". To be sure, you could add aria-hidden="true", which I'd guess most bots don't recognize. http://alistapart.com/article/now-you-see-me/ http://alistapart.com/article/now-you-see-me/
- ghusbands 7y agoMany don't just use display:none but position text off-screen or make it tiny or use sizing and overflow:hidden. I've seen a blind user be tripped up by these, so yes, it often also filters out disabled users.
- icebraining 7y agoMany people use tools incorrectly, that doesn't mean you shouldn't use those tools, you just have to be aware of the problem, which everyone in this (sub)thread now is.
- londons_explore 7y agoA decent screen reader will look at the final rendered Dom and obviously cull items off-screen, the same colour as the background, or 1px high. If it doesn't, its a bug in the screen reader.
- ghusbands 7y agoNo such screen reader exists, so you could claim it's a bug in all of them, but it's not a useful position to take. Screen readers are tricky enough to write without having to second-guess people who are trying to hide-but-not-hide text.
- enobrev 7y agoI agree that it's possible - potentially trivial - for a bot to figure out if a field is hidden from view, but "really ineffective" seems a bit extreme for something I've seen work well multiple times. It's not a definitive solution, but it's an easy and practically free first line of defense for a young project, and depending on the project, can stand for years. Overall, it depends on the sophistication of the bots your project attracts.
- deleted 7y ago[deleted]
- colinbartlett 7y agoIf you work in the Ruby ecosystem at all, there is a gem called invisible_captcha that does just this. It beat back most of the bot signups we were getting, though some still slip through occasionally. https://github.com/markets/invisible_captcha https://github.com/markets/invisible_captcha
- alexpapworth 7y agoAwesome! Love a good Ruby solution. Please keep these coming :)
- ghusbands 7y agoNote that that library is not accessible and is hence illegal to use for most websites in the US. I've raised an issue on the project [1]. [1] https://github.com/markets/invisible_captcha/issues/52 https://github.com/markets/invisible_captcha/issues/52
- oauea 7y agoBlind people are basically bots. If they're not viewing and interacting with the screen it's hard to tell the difference.
- benburleson 7y agoWhoa, it is actually illegal to make "not accessible" websites?
- aaomidi 7y agoYeah it's been the only way to make sure people with disabilities aren't left behind.
- terminous 7y agoIn the US, it is if you're an incorporated business serving as a "public accommodation" as defined in the Americans with Disabilities Act, which includes hotels, restaurants, theaters, storefronts. If it is just your personal blog, it doesn't apply. It is the same law that requires storefronts to have wheelchair ramps, but not homes. See Gil v. Winn-Dixie: https://scholar.google.com/scholar_case?case=6744502269111605689&q=257+F.Supp.3d+1340&hl=en&as_sdt=20006 https://scholar.google.com/scholar_case?case=674450226911160...
- ghusbands 7y agoBe very careful how you do this, unless you want to exclude blind users. I've seen a blind user have an online form silently fail at them because they filled in a field that wasn't visible. Using display:none applied indirectly via CSS is probably reasonably effective against bots and won't interfere with screen-readers.
- mrighele 7y agoAre there tools or guides to help test how websites "appear" to people with disabilities ? It is difficult to design something if you don't have an idea of what will be the outcome, but I wouldn't know which software is used by (e.g.) a blind user, let alone how I would use it.
- kqr 7y agoI couldn't find anything like it, which surprises me. It should be in the interest of companies selling screenreaders that the web is accessible with them. Creating a service where you can submit a link and it shows you a textual representation of how the screenreader sees the page would be immensely useful.
- y4mi 7y agouh, there are a lot of services that do automated scans. These obviously arent completely failsafe, but still give an indicator. just google relevant keywords https://www.google.com/search?q=accessibility+scan+website https://www.google.com/search?q=accessibility+scan+website and if you want the full experience: just enable the screen reader and try to use your website with it. /edit: and i almost forgot: chromes build-in Audit tool in the Developer Panel includes some Accessibility tests as well
- kqr 7y agoThese scans are in my experience always just that: they read the source and match it against a set of common anti-patterns. I was talking about something that would tell me how common commercial screen readers interpret an arbitrary new construct. If you have a specific reference to something else, please send me a link! Screen readers often cost significant amounts of money, and are not trivial to "just turn on".
- eli 7y agoA similar tactic I have is to just require JS to submit a form. Sorry noscript users. That said, we encounter many sophisticated bots and also a decent number of what I'm pretty sure are real people in low-wage countries pasting data into forms. That last one is tough.
- phereford 7y agoHoneypots are the best. It will filter out at least 90% of the spam (or so I have experienced everywhere I have implemented them).
- throwawaymath 7y ago> This does not work for sophisticated bots (never met one) The basic prerogative of a sophisticated bot is to ensure you believe that. Having written a variety of sophisticated bots - some from pre-existing libraries, others from scratch; for specific websites and for general purpose - I'm reasonably confident most people who think they've never seen a sophisticated bot are mistaken. I agree with you that anything more sophisticated or bespoke than a mass-spam bot is rare. But rare things happen often to most websites with nontrivial traffic. The types of bots with the most funding and skill behind them are the ones which don't try to spam anything on a website at all.
- singlow 7y agoBut this is good enough in many cases. It's intended to reduce the volume of input from a form in order to prevent overloading human resources at the next level of filtering. If one or two bots per week get through, it isn't a big deal. Not only are the more sophisticated bots less common, they also tend to not send a bunch of messages. So if you have a contact form, this simple method may reduce the spam content to a low enough level that the effort to implement some type of third-party service is not necessary. There is not enough incentive for someone to target the form directly. In addition, the captcha service may actually deter real submissions, whereas this is completely invisible to non-bots. If you have a form that has a greater incentive for bots to abuse, then you need something more sophisticated.
- nine_k 7y agoAnother interesting approach is to include an input which is not visible: due to `visibility:hidden`, due to being positioned well off-screen (`left: -10000px`), read-only, set unfocusable by keyboard (`tabindex="-1"`), etc. Ideally it would have a varying id / name and a varying ARIA attribute for blind users, saying something like "human users, please ignore this". It would not stop a really sophisticated bot that runs an actual browser and uses machine vision to detect page elements. But unless your site is very high-profile, running such a sophisticated bot to defeat its protections likely won't be profitable.