Hacker News new | past | comments | ask | show | jobs | submit login

That's a pretty cool idea, but I don't like that it's an added step for the user when submitting a form.

I used to get a TON of spam on my website(s) until I threw in a hidden text field. When the form is submitted I assume the submission is spam if the hidden text field's value isn't blank. I don't get spam anymore and people don't have to mess around with a captcha (plus nobody's complained).

...although I'm sure it's only a matter of time until the spammers figure this technique out.




[The ghurlman response must be a response to the OP, not this comment. This approach is perfectly accessible -- better than any captcha!]

I use the "honeypot" field trick as well, and really like it, but this approach has some problems worth mentioning.

For one, make sure you give real users a way to contact you if they somehow get trapped -- you'd think it won't happen, but have you tested every available form-filler plugin out there? A few months ago Google released a new version of Chrome that started putting email addresses into my hidden field. Maybe Chrome thought it was a "confirm your email" field? No idea; I fixed the problem by adding an HTML label for it. But it's a damned good thing I wasn't just secretly discarding the input, or I'd have lost a lot of purchases.

Next, as you mentioned, if anyone targets you specifically, it's trivial to circumvent this with a single line of code in a bot.

There are ways to make it harder to circumvent, though -- use all random field names, insert the hidden field at random locations in the sequence of fields, etc.. I'm still using the simple approach, though, since it's still working. :)


It looks neat, but fails basic accessibility tests. Blind? Can't use a mouse? You're out of luck.


Read again: he includes a hidden field for the "normal" user (blind or not) and spambots fill that field out anyway and get caught. Pretty clever, but not hard to work around as a spammer if this get widely adopted.


Blind users would have a different sort of HTML rendering mechanisms (screen readers, braille output, OCR, etc) that might make hidden tags visible input unless you somehow indicated to them that the field was a honeypot. I'm not sure on the details, but the concept of hiding a field from the user's view probably doesn't translate very well once you leave the visual rendering arena.


I can't speak authoritatively, but I believe the "hidden" attribute of a field is not a visual cue, it is a presentational cue. In other words, it hides it from all presentations, whether visual, audible, tactile, or other.


"Please leave this field blank:" probably works wonders. Visually impaired users aren't mentally impaired, regardless of what the Upright Citizen's Brigade has taught you.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: