Re: [PHP] Re: Alternative/Addition to using a CAPTCHA

Maybe I'm missing something.. if the intent is to have 'hidden' fields that a user would end up submitting but a bot wouldn't.. that wouldn't work very well. A bot could easily see the hidden fields and submit them along with whatever other data they were sending.

If the intention is to trick a bot into sending data a user wouldn't, then again.. doesn't work because a user is going to send the hidden fields as well.

It doesn't really matter if a user can 'see' or edit a form field, a bot can be programmed to send whatever data it finds in that form, hidden or not, because it's only hidden from humans from seeing and editing because that's how the web browsers interpret and render that HTML. Bots don't render HTML, just read it as a text file and parse through it looking for form data and whatever else they're programmed to look for.

Now, if you did an onsubmit on your form that executed a function to modify the HTML pre-submit using JS's innerHTML command, you MIGHT be able to trick it a little. But again, the bots are probably programmed not to be too smart.. but to emulate specific CAPTCHA systems. So a smart bot programmer would notice this and find a way to figure out what form elements were included via innerHTML alteration.

-TG


= = = Original message = = =

I read something (I think on Slashdot) a while back about another method
that could be used to avoid CAPTCHAs.

Basically on top of your standard form field, you place some input fields in
a javascript hidden div around your page conveniently named things like
"email", "address", or "phone." Because they're hidden, when the form
submits they should exist as post variables but have a value untouched by
the user.

Something simple like
<div class="spamcatcher">
<input type="text" name="phonenumber" id="phonenumber" />
</div>

Then <body onload="hideSpamCatcher()">

A spam bot will generally send a value with every field they come across,
especially ones that have really common form field names. They find these
fields by parsing through your source for anything that looks like it's
submitted. If you hid some "trick" fields around your page and then checked
on submit whether or not they had a value, you could probably get a pretty
decent turing test without the user suspecting anything.

My old thrown together blog from a few years back had an unchecked comment
script that caught quite a bit of spam once I stopped caring about it. I've
been considering putting that back together and using this method just to
see if the spam is cut back at all.

Anyone have any experiences (good or bad) with this method?



___________________________________________________________
Sent by ePrompter, the premier email notification software.
Free download at http://www.ePrompter.com.
.

Relevant Pages

  • Re: Spam
    ... Either somebody has played the same trick on you that they played on me, using your email addie as the "From" address on millions of spam that they have sent from their own machine. ... Your PC has been taken over by a worm and become a "bot" in a network of bots, all obeying a master somewhere who is capitalising on his botnet by sending spam, for payment, through his clever programs. ...
    (uk.education.staffroom)
  • Re: email form injection
    ... Proper validation of any field that may come in contact ... That works for not having the bot spam the world. ... I've found spammers are pretty smart about putting appropriate data in fields, now, if your field names have no relation to their content then that isn't an issue, but most of us name fields so we know what they are. ...
    (comp.lang.php)
  • Re: [fw-wiz] The home user problem returns
    ... Spam is a global problem. ... let alone appease angry customers. ... When enough people choose to smoke, ... Recently a bot found it's way onto a customer's computer. ...
    (Firewall-Wizards)
  • Re: email form injection
    ... for not having the bot repeatedly spam the webmaster, store owner, ... webmaster wants to open his mailbox and find 100 orders and 2,000,000 ... And if somebody set up a bot that did what you describe above don't you ... field01, field02 and field03 but nothing in zip? ...
    (comp.lang.php)
  • Re: tell a friend - prevent spam
    ... I dont understand how to use sessions to prevent spam. ... No real way to tell.No of course you can write a bot and thats what is used, but even spammers ...
    (alt.php)