3 ms·
If the bot is tailored to your site, completely ineffective. >Simple inspection of the DOM and CSS ought to be enough to determine whether the field is visible
by macspoofing 13y ago
If the bot is tailored to your site, completely ineffective.
>Simple inspection of the DOM and CSS ought to be enough to determine whether the field is visible and nearby the other fields.
Creating a set of heuristic to detect an invisible (to the user) form would be difficult.
- tantalor 13y agoHas it been attempted? In case not, https://github.com/tantalor/visible-js https://github.com/tantalor/visible-js
- simonrobb 13y agoI realize you only just threw this together, but this only detects the CSS display attribute. The visibility and opacity rules are also easily detected, and a large negative left/margin value could be detected with a small amount of code. However, detection becomes more difficult when you start to consider other techniques such as z-index. It's not as simple as you seem to be implying.
- tantalor 13y agoI only imply it might be simple. I'll reserve judgement until a good counterexample is demonstrated. z-index sounds good! My intention was to pose a challenge to prove that honeypot fields do work, and to distinguish between good and bad implementations (e.g., {display: none}).
- macspoofing 13y agoDon't we think we're clever. If you actually rtfm, you'd realize that the purpose of the honeypot textfields is to create them so that they look like they are visible, to bots, but when rendered on a page they would be invisible to a human (for example: textfield may be under another element, positioned off the viewport, or background set to match the page background). Building a bot to detect all those would be incredibly difficulty. To start, the bot itself would have to actually parse the CSS/HTML/JS and render the page, and then run heuristics to figure out which fields should be ignored.