Fighting comment spam

Are you also annoyed by spam protection in the form of CAPTCHAs? A CAPTCHA is a way to tell a person from a bot during an interaction, such as submitting a web form. With some CAPTCHA images, the Eurotel SMS gateway being the usual example, solving them seems to belong in the realm of miracles and mysteries.

Unfortunately, a CAPTCHA still seems to be the only way to protect web forms from spambots. So I’m following alternatives with interest. Most of the alternative protections I’ve heard about used JavaScript. The basic idea was that JavaScript, which spambots don’t yet interpret, added a known value to the form being submitted.

This week I came across a very interesting alternative that Jirka Bureš came up with.

Here’s another option for fighting comment spam. Use a text field, hidden if you like, that must be left blank. The user doesn’t have to enter anything and can go straight through without being bothered by a prompt. A diligent bot fills in the field and gets stopped.

The discussion below the article says this works but isn’t completely reliable. A bot can work around it. I thought about it for a while and came up with a small improvement that takes Jirka’s idea a little further.

We start with a form input to distinguish a person from a bot. The improvement is to generate the names of the required fields dynamically each time, along with fake fields to use as bait.

Let’s say we have three required fields: first name, surname, and address. Each input will have a dynamically generated name, and the form will also have a dynamically generated number of fake fields. We keep track of which fields are required and which are fake and must be left blank in the session, or we can encode that information in the form itself. To be clear, the number of input fields and their names change dynamically each time the form is displayed.

Do you think this method could be used?