隐藏字段作为 ASP.NET MVC2 应用程序中的（重新）CAPTCHA 替代方案
我正在我目前参与的一个网络项目上编写“联系我们”表格。虽然我过去使用过 reCAPTCHA，但对于这个项目，我不希望界面中出现额外的图像、字段等。
你们中有多少人有过在您的项目中添加一个名为“first_name”的隐藏字段的经验？形式。这个想法是，如果该字段未填充，那么提交者很可能是人类。但后来我问，机器人不会检查该字段是否隐藏吗？
I am writing a "contact us" form on a web project that I am currently involved with. While I've used reCAPTCHA in the past, for this project, I would prefer not to clutter the interface with extra images, fields, etc.
How many of you have had experience in adding a hidden field named something like "first_name" to your form. The idea being that if the field was not populated then the submitter would more than likely be human. But then I ask, wouldn't a bot check if the field was or was not hidden?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
这是完全可行的。机器人不是很聪明，它们很容易被欺骗来填充这些字段，有时称为“蜜罐”。
阅读：
It's entirely feasible. Bots aren't very smart, and they can easily be tricked into filling these fields, some times called "honeypots".
Read:
与其让它成为隐藏字段，不如用 CSS 隐藏它吗？
Instead of making it a hidden field, couldn't you just hide it with CSS?
虽然我很聪明，但我不会把所有的钱都押在上面。即使是更通用的不针对特定站点的机器人也可以轻松重写以跳过隐藏的字段（通过 CSS 或其他任何方式）。如果隐藏字段验证码变得流行，我很确定机器人很快也会为此进行修改。
这篇文章此处提供了一些您可能需要考虑的想法。
Though clever, I would not bet all my money on it. Even the more general not-targeting-a-specific-site bots can easily be rewritten to skip over fields that are hidden (via css or anything). If hidden fields captcha becomes popular, I'm pretty certain the bots will soon also be modified for this.
This article here has some thoughts you might want to consider.
这是验证码的绝佳替代方案，且不会影响可用性。它可能不是 100% 安全，但验证码也不是 100% 安全。
使用 CSS 隐藏字段比
type=hidden更好，因为机器人可以轻松识别并跳过隐藏类型字段。然而，使用 CSS 检测该字段是否隐藏还需要机器人解析 CSS，这虽然可能，但需要更多工作。机器人的目的并不是侵入每个站点。他们只是寻找容易的选择。此外，将隐藏字段命名为模糊的名称，例如 foobar 或类似名称。这是因为浏览器通常会自动填写表单，如果您将其命名为
名字，那么浏览器很有可能会自动填写它。This is a great alternative to Captcha without affecting usability. It might not be 100% secure, but neither is captcha.
It is better to hide the field using CSS than
type=hiddenbecause bots can very trivially recognize and skip hidden type fields. However, detecting that the field is hidden using CSS would require the bot to parse CSS as well, which while possible, is more work. Bots don't aim to break into every site. They merely look for easy pickings.Further, name the hidden field something vague such as
foobaror similar. This is because browsers often autocomplete forms and if you name it something likefirst namethere is a good chance browsers will auto fill it.