3 ms·
Can you expand on that? A separate honey pot sign up page invisible to real users, or something else?
by grey-area 7mo ago
Can you expand on that? A separate honey pot sign up page invisible to real users, or something else?
- mads_quist 7mo agoYou add "hidden" inputs to your HTML form that are named like "First Name" or "Family Name". Bots will fill them out. You will either expect them to be empty or you fill by JavaScript with sth you expect. It's of course reverse-engineerable, but does the trick.
- grey-area 7mo agoThanks, I’ve seen scripted attacks bypass this sort of hidden input unfortunately (perhaps human assisted or perhaps just ignoring hidden fields).
- mads_quist 7mo agoSure, it's really basic of course.
- jaggederest 7mo agoThey often do actually ignore truly hidden fields (input type=hidden) but if you put them "behind" an element with css, or extremely small but still rendered, many get caught. It's similar to the cheeky prompt injection attacks people did/do against LLMs.
- grey-area 7mo agoThanks.
- alexjurkiewicz 7mo agoDoesn't that break password manager autofill?
- bevr1337 7mo agoDo you test this against password managers? Seems like this approach could generate false positives
- imhoguy 7mo agoWatch out, it may break accessibility of your service. If somebody fills these fields I would add extra verification e.g. accessible CAPTCHA.