Re:A negative captcha
by lwf on Monday September 30, 2013 @12:47AM
(#6467846)
I can imagine this might be problematic for people using assistive technology…
[ Parent
| on HN ]
been doing this for years, the way we handle it is to hide the element via javascript. then most screen readers won't "see" it, but generic form bots aren't that smart.
There are HTML attributes you can use to denote things like "ignore this field" for screen readers and the like.
And the bots knows this information as well, and uses it.
Adding a <label> saying "Do not fill this out, antispam filter" should probably be enough to mitigate that. (Disclaimer: I am lucky enough not to have to use screen readers etc.)
I think that it would be easily fixable. Every time you disable an account you send an email to the email address they registered letting them now about it with a link to reactivate it. For the reactivation, you can even add a normal catpcha to prevent the bots exploiting the loophole.
Re:A negative captcha
by scott_karana on Monday September 30, 2013 @02:22AM
(#6468068)
Kinda negates the UI advantage of this approach, doesn't it?
Maybe there's an alternative, like a Javascript-filled ARIA-field that would read out "do not fill this field: robot use only"?
Re:A negative captcha
by samuellevy on Monday September 30, 2013 @03:01AM
(#6468179)
I just label my fields appropriately, and put a "skip to form" link (like a "skip to content" link). Other options exist like using media detection, or JavaScript (very few bots run JavaScript on pages. It slows down the process, and requires more smarts than a generic html parser)
No negative captcha will stand up to a targeted attack, but if you're not running a huge site, targeted attacks are very unlikely.