4 ms·
I was preparing a response here, but many of the other commenters have covered it. I recently spent time ensuring our Auth pages’ HTML could be easily cached o
by charrondev 7y ago
I was preparing a response here, but many of the other commenters have covered it.
I recently spent time ensuring our Auth pages’ HTML could be easily cached outside of our application servers. They were a common target of DDOS attacks because we were generating a unique nonce for CSRF protection.
Randomizing form field names does not defeat a targeted attacker (and we have definitely been a target), prevents HTML caching, and will prevent auto filling fields by browsers and password managers.
Additionally it will be terrible from a usability and accessibility standpoint.
It’s trivial to target a form field by the text/label around it so those would need to be randomized as well.
- dev_dull 7y ago> and will prevent auto filling fields by browsers and password managers. I would MUCH prefer the recaptcha over this!
- tinus_hn 7y agoYour browser probably isn’t smart enough to autofill the ‘comment’ part of a guestbook or the ‘body’ of an email.
- DCoder 7y ago> Randomizing form field names […] will prevent auto filling fields by browsers and password managers. I wholly agree that this would not help, but for the sake of completeness, I want to point out that <input autocomplete=""> [0] is designed to solve this, by decoupling input field names from their intent. But Chrome is playing dumb about it [1]. And of course, the spambots will just adapt to parse the autocomplete info… [0]: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes... [1]: https://www.reddit.com/r/programming/comments/ar1qj1/chromium_is_eroding_the_open_web_and_its_our/egl52wk/ https://www.reddit.com/r/programming/comments/ar1qj1/chromiu...
- deleted 7y ago[deleted]
- nn3 7y ago>Additionally it will be terrible from a usability and accessibility standpoint. ReCaptcha is by definition terrible from a usability and accessibility standpoint too, just has all the privacy problems too.