实现蜜罐式验证码的最佳方法是什么？
我听说过蜜罐风格的验证码系统，或者使用 javascript 加载表单，这可能会在页面呈现后加载。或者检查隐藏字段是否已填写，这可能会得到缓解。
是否有一种完全证明的方法可以在不影响用户体验的情况下实现此功能？
I have heard of honeypot style captcha systems either loading the form with javascript, which might load after the page has rendered. Or checking if a hidden field is filled in, which could possibly be mitigated.
Is there a full-proof way to achieve this functionality without compromising user experience?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
基本思想是让表单包含蜜罐字段，如果填写了这些字段，请求将被拒绝或静默丢弃，并且通过 CSS 或 Javascript DOM 操作使用户不可见。
这是一篇博客文章，它描述了一种相当复杂的方法，使机器人几乎无法区分常规和蜜罐领域。到目前为止，我已经 100% 成功地使用了它，但只有当它们的机器人依赖于字段名称时它才有帮助。我怀疑大多数通用垃圾邮件机器人甚至不会尝试有选择地填写字段，因此您不需要它，并且有针对性的垃圾邮件机器人可以通过字段在 HTML 中的位置而不是名称来识别字段，从而轻松地击败该方案。
The basic idea is to have the form contain honeypot fields that will get the request rejected or silently dropped if they are filled out, and which are made invisible to the user through CSS or Javascript DOM manipulation.
Here's a blog post that describes a fairly complex way of making it nearly impossible for bots to distinguish between regular and honeypot fields. I've used it with 100% success so far, but it only helps if they bots rely on field names. I suspect that most generic spam bots don't even try to fill out fields selectively, so you wouldn't need it, and targeted spam bots would easily defeat the scheme by identifying fields via their position in the HTML rather than the name.