> Randomizing form field names […] will prevent auto filling fields by browsers and password managers.
I wholly agree that this would not help, but for the sake of completeness, I want to point out that <input autocomplete=""> [0] is designed to solve this, by decoupling input field names from their intent.
But Chrome is playing dumb about it [1]. And of course, the spambots will just adapt to parse the autocomplete info…
[0]: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes...
[1]: https://www.reddit.com/r/programming/comments/ar1qj1/chromiu...
>Additionally it will be terrible from a usability and accessibility standpoint.
ReCaptcha is by definition terrible from a usability and accessibility standpoint too, just has all the privacy problems too.
> and will prevent auto filling fields by browsers and password managers.
I would MUCH prefer the recaptcha over this!
I recently spent time ensuring our Auth pages’ HTML could be easily cached outside of our application servers. They were a common target of DDOS attacks because we were generating a unique nonce for CSRF protection.
Randomizing form field names does not defeat a targeted attacker (and we have definitely been a target), prevents HTML caching, and will prevent auto filling fields by browsers and password managers.
Additionally it will be terrible from a usability and accessibility standpoint.
It’s trivial to target a form field by the text/label around it so those would need to be randomized as well.