Hacker News Reader

Comment by bo1024 | Hacker News Reader

I think a "honeypot" HTML input field works well for anything not written explicitly to target your site. If any text is entered, mark as bot/spam.

    <form>
    <div style="display:none">
    If you are human, please ignore this field:
    <input type="text" name="Name" value="My Name">
    </div>
    Name:
    <input type="text" name="actualfield">
    </form>

Bots can't resist. Accessibility is fine, I think.

(Edit: suggested earlier elsewhere in the thread by tyingq: https://news.ycombinator.com/item?id=23090550 )

View on HN

I used this technique in my forms until I realised that the browser's auto-fill also works similar to the bot and will fill fields that has a familiar field name (email, name phone etc). Real users (many of them) who use browsers auto-fill feature will get blocked by this technique. If you add a field with a random field name bots ignore that field.

One thing that works still is using Javascript to create a hidden field and make that field mandatory. Run of the mill bots don't run Javascript yet. However this will exclude people who have disabled Javascript in their browsers.

This works to the extent that bots aren't contextually aware of accessibility semantics. If the bot is mindful to the fact that the field isn't displayed, it could skip it. Which is exactly what screen reader technology would do, due to the "display: none;" rule.

Perhaps the trick could work by displaying it but setting the opacity or the height to 0, and hiding it from screen readers with aria-hidden. But I guess that won't fool the smarter bots.

  > <div style="display:none">

No, don't do this. Just use:

  <form>
    If you are human, please leave this blank:
    <input type="text" name="Name" value="">
    Name:
    <input type="text" name="actualfield">
  </form>

Accessibility should fine if screen readers haven't changed a lot. They skip or are not even aware of display:none blocks

Does the above honeypot work well with bots using headless browsers? Or is actually rendering the page not common enough for bots still?

Does this break things with chrome or LastPass autocomplete?

It shouldn't; you don't fill anything at registration, so even if the password generators prefill it, it should remain empty and can be ignored.

It does though. https://bugs.chromium.org/p/chromium/issues/detail?id=132135

Reply on news.ycombinator.com