2 ms·
CSRF won't usually work unless the spam bot is dumb enough to try and change the token. They usually won't touch hidden fields, the things they like most are <t
by jiggy2011 14y ago
CSRF won't usually work unless the spam bot is dumb enough to try and change the token. They usually won't touch hidden fields, the things they like most are <textarea />.
Doubt re-ordering would make much difference either since they probably work on field names and tags.
CAPTCHA can work but you need a difficult one which will also be difficult for humans. Plus spammers can outsource captcha breaking to humans via injecting them into free porn/torrent/movie sites (solve the captcha to get the content) or just by paying someone in india a few cents.
- krapp 14y agoI wonder whether the problem of captcha farming could be mitigated using branded captchas (which obviously don't belong to a site they might be injected into) and checking referers, and also making them complicated enough that they're not worth whatever the typical per-captcha rate is. Something visual, like a puzzle captcha, instead of filling text out. Then again, that captcha might end up being too complicated for regular users to be willing to fill out as well.