Hacker News Reader

Comment by obituary_latte | Hacker News Reader

I recently set up a WP site and forum for a product my brothers are trying to sell.

We're not allowing commenting on WP, but obviously have to allow people to post on the forum. The forum software offered a couple of (unofficial) anti-spam plugins, but they were not effective at all.

Decided to try re-captcha, but found that to be equally ineffective (hadn't read about just how broken re-captcha is until this incident).

So I spent 10 minutes writing a little script that checks for mouse movement and clears a pre-populated field. If the field isn't empty, bot it is.

Wasn't sure it'd work, but so far, so good. I know it's not ideal and will be a problem for people without js enabled, but the site and product are targeting a demographic in which that's likely to be a rare occurrence so the benefit > risk.

View on HN

Or they're blind, disabled, or simply arthritic, or like Bill: http://diveintoaccessibility.info/day_3_bill.html

That seems clever but is actually a bad idea. I often browse the web with vimium and no mouse movement. I wouldn't be able to comment on your blog. There are better ways of using JS to prevent spam.

"So I spent 10 minutes writing a little script that checks for mouse movement and clears a pre-populated field. If the field isn't empty, bot it is"

Nice idea. I tend not to use the mouse a whole lot once the 'reply' link has been clicked, have you had any complaints of legitimate posts being lost?

I'm wondering if adding a check for key down/up events would mitigate this potential issue since a spam bot is not likely to generate those either.

I think he probably starts checking for the mouse movement as soon as the page loads.

Exactly right, and there is a threshold set. Though it's not used when people try to post but rather when they try to register, I'd imagine it'd work similarly well on an "open" comment page. For a while at least.

It could also just put up a page that says "Because no mouse movement has been detected, there's a possibility you might be a bot; to show you're not, please move your mouse around a bit and then click <submit> again."

Well, I'm not checking when people are trying to post but when they try to register--sorry if I wasn't clear.

The forum requires registration (and verification) before posting, so once they're registered there aren't any restrictions. And one of the benefits of this check is that there aren't any "human verifications" visible to the user. In fact, I could probably do away with the email validation too.

I use browser plugins that allow me to avoid using the mouse (Vimperator for Firefox, for example). It's not unusual for me to run a search query and view several sites using only the keyboard. I'm replying to your post now without ever touching the mouse. I think your approach is clever and the advantages may outweigh the disadvantages, but it may need some refinement to avoid false positives.

I believe you're even more of an outlier than people with javascript disabled.

Eh. It depends upon the audience of your web site. If it's web site with a programmer audience, there is probably going to be a non-trivial portion of your users that are using plugins like vimperator or vimium.

Yes, I'm not sure if this approach would pass the Accessibility test. (Think text-to-speech browsers, customized control setups, and so on. Some people really cannot use a mouse.)

Nice idea, but can you detect mouse movement if the user is using a tablet?

You could easily detect if the browser has emitted any touchstart events.

Similarly you could capture keydown events (specifically arrows and tabs) and pare down the false positives from people using other accessibility devices/browsers.

Apart from captcha farming what are the issues with recaptcha?

They tend to be either too easy for AI to guess, or too hard for even a human to read.

Reply on news.ycombinator.com