Hacker News Reader

if javascript is enabled, it should be trivial to detect a human... (but of course they can log everything)

You don't give bot authors enough credit. They can run JavaScript too and try to replicate human behavior.