News for hackers. Stuff that matters.
Re:Reducing website spam by eli on Thursday December 01, 2011 @02:39PM (#3301110)
Important caveat for using honeypot hidden text fields: use a field name that is gibberish.

If you name the honeypot field something like "address" or "website", you get browser toolbars that will "helpfully" try to pre-fill the field for the user even though it's hidden. And then you're flagging legit users as spammers. I think an ideal system would simply require users who fail the honeypot field to submit a captcha rather than lock them out altogether.

Re:Reducing website spam by TomGullen on Thursday December 01, 2011 @02:41PM (#3301120)
I've done some tests and no browser appears to autofill an HTML hidden field. It's why we picked that method as supposed to CSS as I'm not sure the consequences of this.

Display:hidden on an input field would be OK, but there might be cases on some sites where the field loads before the CSS file. This could cause auto filling to happen. It's a lot harder to test this sort of thing with CSS rules, it's a lot easier just to use hidden fields.

I'd recommend using names such as "username" as honeypots as the likelihood of being filled are high.

Re:Reducing website spam by eli on Thursday December 01, 2011 @02:49PM (#3301145)
Did you test browser toolbars? I've actually been bitten by this. I believe Google Toolbar for IE7 was one of the culprits.