3 ms·

That's a pretty cool idea, but I don't like that it's an added step for the user when submitting a form. I used to get a TON of spam on my website(s) until I t

That's a pretty cool idea, but I don't like that it's an added step for the user when submitting a form. I used to get a TON of spam on my website(s) until I threw in a hidden text field. When the form is submitted I assume the submission is spam if the hidden text field's value isn't blank. I don't get spam anymore and people don't have to mess around with a captcha (plus nobody's complained). ...although I'm sure it's only a matter of time until the spammers figure this technique out.

ghurlman 15y ago
It looks neat, but fails basic accessibility tests. Blind? Can't use a mouse? You're out of luck.
- micheljansen 15y ago
  Read again: he includes a hidden field for the "normal" user (blind or not) and spambots fill that field out anyway and get caught. Pretty clever, but not hard to work around as a spammer if this get widely adopted.
  - evilduck 15y ago
    Blind users would have a different sort of HTML rendering mechanisms (screen readers, braille output, OCR, etc) that might make hidden tags visible input unless you somehow indicated to them that the field was a honeypot. I'm not sure on the details, but the concept of hiding a field from the user's view probably doesn't translate very well once you leave the visual rendering arena.
    - bonzoesc 15y ago
      "Please leave this field blank:" probably works wonders. Visually impaired users aren't mentally impaired, regardless of what the Upright Citizen's Brigade has taught you.
    - eridius 15y ago
      I can't speak authoritatively, but I believe the "hidden" attribute of a field is not a visual cue, it is a presentational cue. In other words, it hides it from all presentations, whether visual, audible, tactile, or other.
jtheory 15y ago
[The ghurlman response must be a response to the OP, not this comment. This approach is perfectly accessible -- better than any captcha!] I use the "honeypot" field trick as well, and really like it, but this approach has some problems worth mentioning. For one, make sure you give real users a way to contact you if they somehow get trapped -- you'd think it won't happen, but have you tested every available form-filler plugin out there? A few months ago Google released a new version of Chrome that started putting email addresses into my hidden field. Maybe Chrome thought it was a "confirm your email" field? No idea; I fixed the problem by adding an HTML label for it. But it's a damned good thing I wasn't just secretly discarding the input, or I'd have lost a lot of purchases. Next, as you mentioned, if anyone targets you specifically, it's trivial to circumvent this with a single line of code in a bot. There are ways to make it harder to circumvent, though -- use all random field names, insert the hidden field at random locations in the sequence of fields, etc.. I'm still using the simple approach, though, since it's still working. :)

ghurlman 15y ago

It looks neat, but fails basic accessibility tests. Blind? Can't use a mouse? You're out of luck.

micheljansen 15y ago
Read again: he includes a hidden field for the "normal" user (blind or not) and spambots fill that field out anyway and get caught. Pretty clever, but not hard to work around as a spammer if this get widely adopted.
- evilduck 15y ago
  Blind users would have a different sort of HTML rendering mechanisms (screen readers, braille output, OCR, etc) that might make hidden tags visible input unless you somehow indicated to them that the field was a honeypot. I'm not sure on the details, but the concept of hiding a field from the user's view probably doesn't translate very well once you leave the visual rendering arena.
  - bonzoesc 15y ago
    "Please leave this field blank:" probably works wonders. Visually impaired users aren't mentally impaired, regardless of what the Upright Citizen's Brigade has taught you.
  - eridius 15y ago
    I can't speak authoritatively, but I believe the "hidden" attribute of a field is not a visual cue, it is a presentational cue. In other words, it hides it from all presentations, whether visual, audible, tactile, or other.

jtheory 15y ago

[The ghurlman response must be a response to the OP, not this comment. This approach is perfectly accessible -- better than any captcha!] I use the "honeypot" field trick as well, and really like it, but this approach has some problems worth mentioning. For one, make sure you give real users a way to contact you if they somehow get trapped -- you'd think it won't happen, but have you tested every available form-filler plugin out there? A few months ago Google released a new version of Chrome that started putting email addresses into my hidden field. Maybe Chrome thought it was a "confirm your email" field? No idea; I fixed the problem by adding an HTML label for it. But it's a damned good thing I wasn't just secretly discarding the input, or I'd have lost a lot of purchases. Next, as you mentioned, if anyone targets you specifically, it's trivial to circumvent this with a single line of code in a bot. There are ways to make it harder to circumvent, though -- use all random field names, insert the hidden field at random locations in the sequence of fields, etc.. I'm still using the simple approach, though, since it's still working. :)