4 ms·
I've heard this concept described as a "honeypot field" before and it works pretty well as you've said. I'm curious how password managers/autofill avoid trippin
by mc10 3y ago
I've heard this concept described as a "honeypot field" before and it works pretty well as you've said. I'm curious how password managers/autofill avoid tripping up though; are they able to detect that the field is not visible?
- pavel_lishin 3y agoPassword managers typically only fill specified fields - username & password - and leave others alone.
- mc10 3y agoMaybe I'm thinking specifically of 1Password which can store your previously-filled out form fields as well as autofill fields like address or credit card number.
- ChrisMarshallNY 3y agoIt would store the defaults, I suppose. I got the idea from a book. Can't remember which, but it may have been in the early oughties, or even last century (and the book called it "Honeypot Fields"). The nice thing was, the user didn't have any friction at all. They had a subject and message. No CAPTCHAS, no math problems. Nothing. The form was on a site with a fair bit of exposure and traffic. Another similar site used Contact Form 7 (or whatever the predecessor to it was), and we would get fairly regular spams. This was a plugin that I hand-crafted.
- TheCapeGreek 3y agoIf it can detect HTML input fields and what to put in them, I'm sure it can also determine if a field is hidden (either by hidden property or styling) and avoid it?
- mc10 3y agoYeah I guess it depends on how sophisticated the "hiddenness" of the field is. Instead of straight up using the hidden property (which is easier for a bot to detect), you could try other things, like moving the input field offscreen and using overflow: hidden, or styling it such that it's the same color as the background and is unfillable. Now though you'll need to worrying about tabbing through fields (change tabindex to -1) and screen readers that might pick up the fields.