9 ms·
Have an input element that can't be seen. If it has something in it, ignore the submit. Works for all my sites so far.
by sbov 7y ago
Have an input element that can't be seen. If it has something in it, ignore the submit. Works for all my sites so far.
- charrondev 7y agoDoesn’t work as soon as you’re big enough to target. The company I work for makes a SaSS forum product, and while we do have multiple spam prevention methods (akismet, stopforumspam, honeypot, a hidden input), there’s enough stuff out there that has targeted our platform that a Recaptcha on the registration form is needed. We haven’t need it on any other forms yet though. After registration it’s all handled by the other methods and various moderation tools.
- mattigames 7y agoDid you try randomizing the 'name' and 'ids' of the inputs? (including the invisible one)
- korm 7y agoIt's trivial to detect element visibility, this just doesn't work in bigger sites.
- mattigames 7y agoYou are right it doesn't work but is not trivial at all to detect visibility, there are millions of ways to hide an element using CSS, for example a rare one (without using "opacity", "display" or "visibility") is: transform: scale(0.00001);
- kbenson 7y agoThe only way I see this being useful is if you do this for one or more elements as well as encrypt the name of every input element and also randomize the layout enough that they can't easily use CSS selectors or regular expressions to fine the relevant inputs by page location. I can and have defeated forms that tried to do all of those things very easily in the past. Keep in mind that if you randomize across a few variations (i.e. 4-5 page layouts), that's easily discerned if you pull the page source down 20-30 times, doa complex diff, scrub out obviously random strings, and check the total unique variations you're seeing. That may seem like a lot of work, but consider that if you don't do it all at once, but instead roll out small change after small change, the person or people using it are not weighing to cost to do everything required to bypass it compared to finding another open mail form, but the cost to bypass just the new fix you put in place. Also, they might think it's fun doing so... And on the site dev's side, they can just choose to outsource it to a CAPTCHA (not that there aren't services to easily bypass CAPTCHAs at scale at sub-cent per CAPTCHA rates, see https://anti-captcha.com/ https://anti-captcha.com/). Note: To forestall any assumptions, I wasn't doing any spamming or helping spamming in any way.
- T-hawk 7y agoYou're not trying to make your site absolutely bot-proof. Someone deliberately targeting your site can figure out any such measures. (You want legitimate users to do so.) You're just trying to throw in enough friction that most common drive-by scripts won't succeed. It's a "don't have to outrun the bear" situation, make yourself just difficult enough that some easier target gets snagged instead.
- kbenson 7y ago> It's a "don't have to outrun the bear" situation If everyone else is incorporating recaptcha, they're all running faster than you. Even with bypass services, cheap is not the same as free, especially at the scale spam runs at. I imagine a mail form that obviously doesn't incorporate a CAPTCHA is going to garner some attention. It might work for weeks or months if it's not being paid attention to, so that's probably worth them spending a few minutes looking at.
- luckylion 7y ago> Even with bypass services, cheap is not the same as free, especially at the scale spam runs at. Spam doesn't scale on a small site. Say you can absolutely fill a small site with spam comments to the point that 99% of comments are spam. Very few people visit the site (it's small after all). Fewer still read the comments. Virtually none of those will click on the (usually obvious) spam links. And still fewer will buy, making you money. If you spend 2 hours customizing your spam script to circumvent anti-spam measures on a small site, you might as well flip burgers at McDonald's, you'll make significantly more money. Spam works at scale only when you're not customizing. I'm involved with quite a few small to medium and a few larger sites (the largest getting around 4m PI/month) and though we use WP we get virtually no spam because of trivial deviations. We get an immense amount of attempts though. The little we do get is obviously manual spam: in the correct language, with content targeted to the individual page/post content (beyond "very interesting article, I wrote about the same" one-size-fits-all).
- 7y ago
- mobjack 7y agoI really dont know how well that will work against a dedicated attacker. I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own solution. I dont want to hope that an alternative is good enough for my needs. I want the best when it comes to protecting my site. Any alternative needs to have a proven track record and support to make consider replacing ReCAPTCHA.
- deleted 7y ago[deleted]
- jachee 7y agoHow much does ReCAPTCHA's aggressively targeting non-Chrome and/or privacy-enabled browsers and making completing captchas exceedingly difficult factor in your decision? Do you want your site "protected" from those users, too?
- briandear 7y agoSo you force your users to consent to sharing all of their data with Google? That’ll teach ‘em.
- sb8244 7y agoWhat's an alternative that works at scale, though? It's easy to say "this is bad for these reasons, don't use it" while ignoring that there's not really better options once you get targeted.
- sb8244 7y agoTo clarify, I do think that this post gives good alternatives because most spam is not targeted. However, you must do something like this if you're a big site or a small site who pissed someone off
- atoav 7y agoThe reasonable thing to do would be to initially create challanges with multiple levels/difficulties so you can quickly change the mechanism when you are really targeted. For my personal blog I managed to be spam free with a simple question/answer pair for 5 years. Took me a minute to implement and leaves my user data where it belongs.
- charrondev 7y agoI was preparing a response here, but many of the other commenters have covered it. I recently spent time ensuring our Auth pages’ HTML could be easily cached outside of our application servers. They were a common target of DDOS attacks because we were generating a unique nonce for CSRF protection. Randomizing form field names does not defeat a targeted attacker (and we have definitely been a target), prevents HTML caching, and will prevent auto filling fields by browsers and password managers. Additionally it will be terrible from a usability and accessibility standpoint. It’s trivial to target a form field by the text/label around it so those would need to be randomized as well.
- dev_dull 7y ago> and will prevent auto filling fields by browsers and password managers. I would MUCH prefer the recaptcha over this!
- tinus_hn 7y agoYour browser probably isn’t smart enough to autofill the ‘comment’ part of a guestbook or the ‘body’ of an email.
- DCoder 7y ago> Randomizing form field names […] will prevent auto filling fields by browsers and password managers. I wholly agree that this would not help, but for the sake of completeness, I want to point out that <input autocomplete=""> [0] is designed to solve this, by decoupling input field names from their intent. But Chrome is playing dumb about it [1]. And of course, the spambots will just adapt to parse the autocomplete info… [0]: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes... [1]: https://www.reddit.com/r/programming/comments/ar1qj1/chromium_is_eroding_the_open_web_and_its_our/egl52wk/ https://www.reddit.com/r/programming/comments/ar1qj1/chromiu...
- deleted 7y ago[deleted]
- PopeDotNinja 7y agoPlease just don't use the bouncing ball that Dropbox made me use once. It was the first time my lack of athleticism prevented me from a signing in.
- spongeb00b 7y agoI’ve not heard of this one before. Wouldn’t it cause serious problems for accessibility?
- PopeDotNinja 7y agoAlmost certainly.
- peteretep 7y agoWhat is that? This comment is the first Google result for dropbox bouncing ball.
- PopeDotNinja 7y agoI tried from finding it myself, and I've only seen it once. I was logging into Dropbox via Chrome on my Android phone, and I must have done something to trigger captcha spambot hell. I just tried triggering it again and was not able to do so. The ball had an animal in it and I was asked to bounce the ball, causing it to rotate. I had to bounce the ball with just enough force to get it to land so the animal was positioned upright. After several failed attempts, I gave up.
- buboard 7y agodo you eliminate all spam that way? i get signup SEO spam even with recaptcha & stopforumspam.
- charrondev 7y agoNo it does not. Some creeps through the registration system, which is why we have additional trust measures afterwards. On my own site I see 1 or 2 spam posts a week although I get the feeling it’s real people doing the registration. They sign up, make 1 comment, get reported very quickly, then banned. We haven’t had to make our signup/registration system that strong in of itself though, because most of our largest clients end up using some SSO method exclusively and will have their own prevention methods.
- savrajsingh 7y agoThat is smart
- deleted 7y ago[deleted]
- netok 7y agoIt will also ignore people who use browser's autofill form function. Realized this after receiving a dozen complaints.
- mattigames 7y agoYou can randomly generate the "name" of the fields and autofill will never fill them, another option to disable autocomplete is to leave them without "name" and handling the submit using JavaScript.
- smt88 7y agoDisabling autocomplete is user-hostile and additionally should be considered a security flaw. It makes it harder to use password managers.
- analogmemory 7y agoYou can disable a single input field from autocomplete `autocomplete="off"`
- fybe 7y ago'Autocomplete' doesn't work for Firefox (since version 38), Google Chrome (since 34), and Internet Explorer (since version 11 Huge pain
- analogmemory 7y agoThis totally works in latest Chrome/FF/Safari https://codesandbox.io/s/static-jkvzs https://codesandbox.io/s/static-jkvzs https://jkvzs.codesandbox.io/ https://jkvzs.codesandbox.io/ The other trick is to add a random string/number in from of the name attribute e.g. name="348349_name". This prevents autofill. Interestingly 1Password and LastPass are smart enough to infer that it's a name or email field. For the honeypot, random number + word makes it ignored by autofill/1password
- GordonS 7y agoI did this years ago, it expecting it to work - but there hasn't been a single form spam since! I'm sure this won't work for everyone, but if your small, I highly recommend giving it a go.
- tutanchamun 7y agoYeah, these honeypotts work quite well, however the last time I looked into it (circa 2012) I read that it is not ideal for visually impaired users with screen readers.
- jrphenow 7y agoI forget everything that you need to do, but I believe I read that there's a happy medium you can strike such that a script would still input data but it wouldn't be shown to a screen reader.
- darekkay 7y agoThis field will also been available for all screen reader users. It's important to add an adequate label ("Please do not fill out this field" or similar).
- dasanman 7y agoWe used to this, does not seem to work at all these days anymore
- UncleMeat 7y agoNow your site is terrible for blind people.