Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I use honeypot fields, but you have to be really careful with them, and certainly do NOT just discard requests with the honeypot field filled, as the article suggests.

About 6 months ago, the new version of Chrome started auto-filling email addresses into my honeypot field, so it was a good thing I returned a friendly message (explaining that some auto form-fillers might cause this error, and needed to be temporarily disabled) rather than just assuming "bot".. but I still had some pissed-off people who had been trying to give me money and couldn't.

It's also worth noting that honeypot fields are only useful on a small site that is unlikely to be specifically targeted. A custom-tweaked bot can very easily bypass a honeypot field, of course.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: