3 ms·

I am afraid that password managers like 1Password will get caught in this. I always use it not only to remember my password, but also to fill in sign up forms w

I am afraid that password managers like 1Password will get caught in this. I always use it not only to remember my password, but also to fill in sign up forms with my data. I am sure it would fall for the honeypot and it would be very hard for me to find out what went wrong. I am sure the experience would be incredibly frustrating.

tantalor 13y ago
How effective are these honeypot form fields? There are only so many ways to make a form field invisible. Simple inspection of the DOM and CSS ought to be enough to determine whether the field is visible and nearby the other fields.
- macspoofing 13y ago
  If the bot is tailored to your site, completely ineffective. >Simple inspection of the DOM and CSS ought to be enough to determine whether the field is visible and nearby the other fields. Creating a set of heuristic to detect an invisible (to the user) form would be difficult.
  - tantalor 13y ago
    Has it been attempted? In case not, https://github.com/tantalor/visible-js https://github.com/tantalor/visible-js
    - simonrobb 13y ago
      I realize you only just threw this together, but this only detects the CSS display attribute. The visibility and opacity rules are also easily detected, and a large negative left/margin value could be detected with a small amount of code. However, detection becomes more difficult when you start to consider other techniques such as z-index. It's not as simple as you seem to be implying.
      - tantalor 13y ago
        I only imply it might be simple. I'll reserve judgement until a good counterexample is demonstrated. z-index sounds good! My intention was to pose a challenge to prove that honeypot fields do work, and to distinguish between good and bad implementations (e.g., {display: none}).
    - macspoofing 13y ago
      Don't we think we're clever. If you actually rtfm, you'd realize that the purpose of the honeypot textfields is to create them so that they look like they are visible, to bots, but when rendered on a page they would be invisible to a human (for example: textfield may be under another element, positioned off the viewport, or background set to match the page background). Building a bot to detect all those would be incredibly difficulty. To start, the bot itself would have to actually parse the CSS/HTML/JS and render the page, and then run heuristics to figure out which fields should be ignored.
- Flavius 13y ago
  They are so effective that you'll get dozens of support tickets from the 1Password users that can't sign up or log in. Although this is the best way to avoid spam, I cannot recommend it unless you don't care about lost customers.
  - eridius 13y ago
    If they can't sign up, can they even send you support tickets? The worst part about blocking legitimate sign-ups is you may be making it impossible to even hear their problems.

tantalor 13y ago

How effective are these honeypot form fields? There are only so many ways to make a form field invisible. Simple inspection of the DOM and CSS ought to be enough to determine whether the field is visible and nearby the other fields.

macspoofing 13y ago
If the bot is tailored to your site, completely ineffective. >Simple inspection of the DOM and CSS ought to be enough to determine whether the field is visible and nearby the other fields. Creating a set of heuristic to detect an invisible (to the user) form would be difficult.
- tantalor 13y ago
  Has it been attempted? In case not, https://github.com/tantalor/visible-js https://github.com/tantalor/visible-js
  - simonrobb 13y ago
    I realize you only just threw this together, but this only detects the CSS display attribute. The visibility and opacity rules are also easily detected, and a large negative left/margin value could be detected with a small amount of code. However, detection becomes more difficult when you start to consider other techniques such as z-index. It's not as simple as you seem to be implying.
    - tantalor 13y ago
      I only imply it might be simple. I'll reserve judgement until a good counterexample is demonstrated. z-index sounds good! My intention was to pose a challenge to prove that honeypot fields do work, and to distinguish between good and bad implementations (e.g., {display: none}).
  - macspoofing 13y ago
    Don't we think we're clever. If you actually rtfm, you'd realize that the purpose of the honeypot textfields is to create them so that they look like they are visible, to bots, but when rendered on a page they would be invisible to a human (for example: textfield may be under another element, positioned off the viewport, or background set to match the page background). Building a bot to detect all those would be incredibly difficulty. To start, the bot itself would have to actually parse the CSS/HTML/JS and render the page, and then run heuristics to figure out which fields should be ignored.
Flavius 13y ago
They are so effective that you'll get dozens of support tickets from the 1Password users that can't sign up or log in. Although this is the best way to avoid spam, I cannot recommend it unless you don't care about lost customers.
- eridius 13y ago
  If they can't sign up, can they even send you support tickets? The worst part about blocking legitimate sign-ups is you may be making it impossible to even hear their problems.