4 ms·
This is simple form of a honeypot but it is really ineffective. Any bot with even minimal sophistication will know to leave the hidden field empty.
by willio58 7y ago
This is simple form of a honeypot but it is really ineffective. Any bot with even minimal sophistication will know to leave the hidden field empty.
- corobo 7y agoYou hide it with CSS, not type='hidden'
- dev_256 7y agoYou can still figure out it's hidden.
- IshKebab 7y agoSure but the point is that almost nobody does.
- SquareWheel 7y agoIt really doesn't matter. display:none or position:absolute;left:-1000px makes little difference. Honey pots only catch a small number of bots.
- corobo 7y agoI only have anecdata of course but so far I've had a 100% success rate. I imagine this will come down eventually but for the past ~year or so it's been working fine to just hide the honeypot field with CSS
- SquareWheel 7y agoI'm glad it's worked for one of us at least.
- corobo 7y agoI don't know if it helps any but I've been using a field that looks real. Depending on where it is the name= would be surname (where the form submission has a name field rather than a first name surname split), website, url, etc
- Lunatic666 7y agoI just removed Google's ReCaptcha for a honeypot solution with an additional name and url field. But there's also a timer which checks how long it takes you to submit the form. If you can fill out everything in <2s, you're most likely not human. I have to figure out how people with disabilities can use the page though. Good to get a reminder here. So far it performs way better than ReCaptcha, I haven't received any spam so far and plenty of ham of course. No human complaints either.
- SquareWheel 7y agoA timer is a novel idea. I hadn't seen that suggested before. Do you anticipate any problems with form auto-filling tools?
- mikojan 7y agoSo now you're filtering out bots and people with disabilities?
- vbezhenar 7y agoYou can set placeholder with something like "leave it empty".
- icebraining 7y agoNope, screen readers (usually?) ignore elements with "display: none". To be sure, you could add aria-hidden="true", which I'd guess most bots don't recognize. http://alistapart.com/article/now-you-see-me/ http://alistapart.com/article/now-you-see-me/
- ghusbands 7y agoMany don't just use display:none but position text off-screen or make it tiny or use sizing and overflow:hidden. I've seen a blind user be tripped up by these, so yes, it often also filters out disabled users.
- icebraining 7y agoMany people use tools incorrectly, that doesn't mean you shouldn't use those tools, you just have to be aware of the problem, which everyone in this (sub)thread now is.
- londons_explore 7y agoA decent screen reader will look at the final rendered Dom and obviously cull items off-screen, the same colour as the background, or 1px high. If it doesn't, its a bug in the screen reader.
- ghusbands 7y agoNo such screen reader exists, so you could claim it's a bug in all of them, but it's not a useful position to take. Screen readers are tricky enough to write without having to second-guess people who are trying to hide-but-not-hide text.
- enobrev 7y agoI agree that it's possible - potentially trivial - for a bot to figure out if a field is hidden from view, but "really ineffective" seems a bit extreme for something I've seen work well multiple times. It's not a definitive solution, but it's an easy and practically free first line of defense for a young project, and depending on the project, can stand for years. Overall, it depends on the sophistication of the bots your project attracts.
- deleted 7y ago[deleted]