3 ms·
That's wasted effort. The bots are usually built by humans, and the humans can detect that and build the bot to ignore text fields with margin < -1000 or the un
by djb_hackernews 15y ago
That's wasted effort. The bots are usually built by humans, and the humans can detect that and build the bot to ignore text fields with margin < -1000 or the unique name or something.
- ydant 15y agoI think it depends on if you are trying to avoid automated attacks or targeted attacks. There seem to be a lot of bots scanning for vulnerable sites - this would potentially work for those. If you get targeted specifically, then, yeah, the human in charge can figure it out in short order.
- aik 15y agoI agree. I think this method is a great idea and is much more foolproof: "You could also use Honeypot Captcha approach: you can create a honeypot form field that should be left blank and then use CSS to hide it from human users, but not bots. When the form is submitted, you check to make sure the value of that form field is blank." http://haacked.com/archive/2007/09/11/honeypot-captcha.aspx http://haacked.com/archive/2007/09/11/honeypot-captcha.aspx
- djb_hackernews 15y agoFails the same test. I build what can be considered bots for a living, though they have nothing to do with spamming or otherwise shady reasons. Part of the process in building the bot is to send exactly what a browser would send, and we do this by actually making the requests in a browser and viewing the raw request. If my browser doesn't send a honeypot captcha, neither does my bot.
- aik 15y agoSay you have a field hidden with a div on a low profile, minimum traffic site (100 visitors a week). It's incredibly unlikely and pretty dumb for a bot to be made specifically for that site -- in this case, how could a bot determine whether that field should contain a value or not?