4 ms·

I think a "honeypot" HTML input field works well for anything not written explicitly to target your site. If any text is entered, mark as bot/spam. <form>

by bo1024 6y ago

I think a "honeypot" HTML input field works well for anything not written explicitly to target your site. If any text is entered, mark as bot/spam. <form> <div style="display:none"> If you are human, please ignore this field: <input type="text" name="Name" value="My Name"> </div> Name: <input type="text" name="actualfield"> </form> Bots can't resist. Accessibility is fine, I think. (Edit: suggested earlier elsewhere in the thread by tyingq: https://news.ycombinator.com/item?id=23090550 https://news.ycombinator.com/item?id=23090550 )

xrendan 6y ago
Does this break things with chrome or LastPass autocomplete?
- Cthulhu_ 6y ago
  It shouldn't; you don't fill anything at registration, so even if the password generators prefill it, it should remain empty and can be ignored.
  - sp332 6y ago
    It does though. https://bugs.chromium.org/p/chromium/issues/detail?id=132135 https://bugs.chromium.org/p/chromium/issues/detail?id=132135
smoe 6y ago
Accessibility should fine if screen readers haven't changed a lot. They skip or are not even aware of display:none blocks Does the above honeypot work well with bots using headless browsers? Or is actually rendering the page not common enough for bots still?
JMTQp8lwXL 6y ago
This works to the extent that bots aren't contextually aware of accessibility semantics. If the bot is mindful to the fact that the field isn't displayed, it could skip it. Which is exactly what screen reader technology would do, due to the "display: none;" rule.
- vekker 6y ago
  Perhaps the trick could work by displaying it but setting the opacity or the height to 0, and hiding it from screen readers with aria-hidden. But I guess that won't fool the smarter bots.
a1369209993 6y ago
> <div style="display:none"> No, don't do this. Just use: <form> If you are human, please leave this blank: <input type="text" name="Name" value=""> Name: <input type="text" name="actualfield"> </form>
prasanthmj 6y ago
I used this technique in my forms until I realised that the browser's auto-fill also works similar to the bot and will fill fields that has a familiar field name (email, name phone etc). Real users (many of them) who use browsers auto-fill feature will get blocked by this technique. If you add a field with a random field name bots ignore that field. One thing that works still is using Javascript to create a hidden field and make that field mandatory. Run of the mill bots don't run Javascript yet. However this will exclude people who have disabled Javascript in their browsers.

by bo1024 6y ago

xrendan 6y ago

Does this break things with chrome or LastPass autocomplete?

Cthulhu_ 6y ago
It shouldn't; you don't fill anything at registration, so even if the password generators prefill it, it should remain empty and can be ignored.
- sp332 6y ago
  It does though. https://bugs.chromium.org/p/chromium/issues/detail?id=132135 https://bugs.chromium.org/p/chromium/issues/detail?id=132135

smoe 6y ago

Accessibility should fine if screen readers haven't changed a lot. They skip or are not even aware of display:none blocks Does the above honeypot work well with bots using headless browsers? Or is actually rendering the page not common enough for bots still?

JMTQp8lwXL 6y ago

This works to the extent that bots aren't contextually aware of accessibility semantics. If the bot is mindful to the fact that the field isn't displayed, it could skip it. Which is exactly what screen reader technology would do, due to the "display: none;" rule.

vekker 6y ago
Perhaps the trick could work by displaying it but setting the opacity or the height to 0, and hiding it from screen readers with aria-hidden. But I guess that won't fool the smarter bots.

a1369209993 6y ago

> <div style="display:none"> No, don't do this. Just use: <form> If you are human, please leave this blank: <input type="text" name="Name" value=""> Name: <input type="text" name="actualfield"> </form>

prasanthmj 6y ago

I used this technique in my forms until I realised that the browser's auto-fill also works similar to the bot and will fill fields that has a familiar field name (email, name phone etc). Real users (many of them) who use browsers auto-fill feature will get blocked by this technique. If you add a field with a random field name bots ignore that field. One thing that works still is using Javascript to create a hidden field and make that field mandatory. Run of the mill bots don't run Javascript yet. However this will exclude people who have disabled Javascript in their browsers.