Shloime Henig Points Out HUGE Error In My Current Anti-Spam Technique
Posted February 6, 2007 at 8:56 AM
Shloime Henig contacted me a few days ago to point out a HUGE issue he found with my anti-spam form submissions technique. I use a number of hidden form fields that a standard user will not see to help me separate the good users from the spam bots. The problem, as Shloime pointed out, is that if any one has form auto-fill turned on in their browser (via some Browser plugin or what-have-you), it will alter the hidden fields unbeknown to the user.
Altering these fields, of course, makes my code thing that the form was submitted by a spam bot and rejects them. I am sorry if this has happened to any of you (getting your comments rejected). I am going to be moving to a much more simple technique (version 4) very soon.
Thanks Shloime, you rock!
Comments (6) | Post Comment | Ask Ben | Permalink | Other Searches | Print Page
Hey, Where'd That Goofy Bastard Go?
You Really Shouldn't Be Here jQuery, My Wife Might Begin To Suspect Something
Reader Comments
Looking forward to it! Keep us up to date on where you are heading with that.
Posted by Javier Julio on Feb 6, 2007 at 9:44 AM
It is going to be, in part, based on the stuff Michael Dinowitz did, but not using an application-scoped key. Who knows, we will see.
Posted by Ben Nadel on Feb 6, 2007 at 10:14 AM
Yeah, I thought of that in my own implementation. You should still use the same words in the field names so hopefully the bot or [human] bot configurer will still try to enter data into them. So I was using URL2 and email2 in a test so as to not trigger the autofill of google toolbar or the like...
I've been reading your anti-spam techniques and appreciate them, so I wanted to pass on this related article that I thought had some really interesting techniques too: http://www.nedbatchelder.com/text/stopbots.html
Posted by Doug on Feb 7, 2007 at 11:36 AM
What if you used a textarea with style="display:none;", rather than an input with type="hidden"? Do common autofill apps try to autofill textareas as well as inputs?
Posted by Steve on Feb 11, 2007 at 12:48 PM
Steve,
Yeah, I think I am gonna end up doing something like that. That's how my previous anti-spam technique worked. I just need to tweak and simplify.
Posted by Ben Nadel on Feb 11, 2007 at 5:21 PM
@Dan, @Steve,
Yeah, that is what I have done. In conjunction with the encrypted timestamp, I have added a hidden textarea or two. Dan, it was cool to know those had a name, Honeypot. Good stuff.
Posted by Ben Nadel on Feb 12, 2007 at 3:28 PM
