Hacker News Reader

Comment by tyingq | Hacker News Reader

I do use a CAPTCHA, but not on a login form. It's solely for a "contact us" form. We do try to encourage just regular email with a mailto: href, but unfortunately, customers expect a form.

And, if I don't use the captcha, we get flooded with spam. We are using Google's "nocaptcha", which is usually unintrusive, but is a pain for anyone not logged into some Google property.

View on HN

Also a pain for anybody using tracking blocking. I get captchas all day on all kinds of sites and I'm always logged into anywhere from 3-12 google accounts.

We do put a clickable mailto: url on the page as well. Unfortunately, unprotected forms get tons of automated spam. Emailing a verification doesn't work well...customers just don't pay attention to instructions :)

I just base64 encode my email address and decode it in an onload event handler. Most bots don't seem to execute JS because I haven't received a spam email yet.

Sucks for users with JS disabled though.

I manage to get rid of line 99.99% of spam with a hidden checkbox. Bots tend to check them, so I just ignore it if it's checked.

I remember reading about a blog that used this method something like 10 years ago, and wondered why I don't hear about it more often. Glad to know it still works just as well as back then.

I made a contact form that sends the data URL encoded if JS is disabled, or JSON if JS is enabled. If the back end gets url-encoded data, it's spam.

I also use the hidden field trick, but I label it phone number and fill it with zeros. Then I hide it with an external stylesheet. I don't actually want a phone field, its a decoy. If it is changed from zeros, it is spam. Most spam bots don't seem to parse external stylesheets.

I've had zero contact form spam with this method. Mind you it is a very low volume site.

I was just having fun with it, making a php-style contact form backend but using node.js. I read lots of those old blog posts you mention.

Then I suggest a simple change away from Google:

Make some text asking a question "What is five plus 2?" And there's an empty text field next to it that on the backend looks for the trivial right answer.

That should reasonably stop spam, and still allow a field based html mail sender. And eliminates a dependency on Google.

For a contact form I think it's ok to show a challenge. It won't eliminate spam entirely or work against targeted attacks, but at least it keeps out the bulk of annoyances (at the cost of annoying some of your users :P).

EDIT: Have you considered putting the messages in a pending state instead? You could ask for their email in the contact form, and send a confirmation link that needs to be clicked for the message to be validated. Unvalidated messages could be deleted after a week, without any human interaction. I'd expect this to have comparable effectiveness against untargeted spam.

Not annoying; blocking. There are a reasonable percentage of people that cannot solve the current set of CAPTCHAs.

Yes, and Google also blocks the audio challenge sometimes, so people with impaired vision or with neurological issues that affect object recognition are effectively denied access to a large portion of the web.

At some point the ADA will come into play. Google has to realize that... don't they?

nocaptcha aka reCAPTCHAv3 is the worst choice. At least with v2 users of firefox/adblock/ec get a chance of passing the captcha by answering challenges. v3 takes that opportunity away from them.

Reply on news.ycombinator.com