Spam Bots and CAPTCHAs

For all the havoc spambots wreak on blogs their presence has actually done some good. You see, these annoying creatures from cyberspace have brought out the creative sides of blog owners determined to win this Battle of the Blogs.

To make my point read this post by Ned Batchelder titled,

“Stopping Spambots with Hashes and Honeypots.” In it he shares his homespun solution to this ever-present problem. Ned’s upfront and honest when he tells readers that his method isn’t 100% effective. But he points to his blog as proof that this solution is better than anything he’s tried so far, except perhaps for Textual CAPTCHA. (Which in his opinion users are tired of.)

Ned’s solution targets those annoying form-filling bots. He claims that to beat these bots all you have to do is add onto your forms one editable field that’s invisible to the human eye. That’s the honeypot field, but it’s not a hidden field. That’s different. Since human visitors can’t see this field they won’t ever fill it in.

But form-filling bots see these honeypots and every other field on your forms. And they’ll happily fill in whatever they think is required for the fields they encounter. That’s what gets them into trouble with Ned’s solution. By populating the honeypot field they reveal themselves for the scourge they are!

At that point Ned safely assumes it’s a bot and invalidates the submission. Access is denied the form-filling bot and with nothing left to do it leaves for some other unsuspecting blog.

In his post Ned explains the validation process in more detail and offers several simple ways to make honeypot fields invisible. He also disputes a few common criticisms of his solution. Read the blog and be amazed by this solution’s sheer simplicity!

You have to because next time I’ll speculate on the joke in Ned’s post.