4 ms·
<div style="position: absolute; left: -2000px;"> will definitely cause problems with screen readers. These problems can be mitigated to some extent if you have
by kijin 13y ago
<div style="position: absolute; left: -2000px;"> will definitely cause problems with screen readers.
These problems can be mitigated to some extent if you have multiple tests and allow clients to fail some of them. That's the approach I used in my latest project. There are approx. 10 tests. Some use CSS and JS. Some use random tokens and hashes. Some are based on assumptions about the target demographic, such as their location, preferred language, and browser capabilities. (e.g. If you're accessing a mobile site with an IE7 user agent, something's fishy.)
Fail any one of them, and your submission is accepted but flagged. Fail two, and your submission is rejected. Fail two X times in Y minutes, and your IP is banned for Z hours. (The fail2ban approach is useful when someone tries to brute-force your hashed field names.)
Occasionally, of course, you're going to run into a legitimate client who fails two or more tests simultaneously, e.g. someone who uses a screen reader with a crappy autofill plugin. But those cases should be exceedingly rare. In any case the rules can be easily adjusted.
- eli 13y agoThat sounds too complicated and fragile for me to use. Really, I was just getting at that you should probably label the field as "Do not type anything in this box" so users with assistive devices don't get trapped. I'd also provide a useful, non-cryptic error message for if the captcha fails.