What is a good invisible captcha?

Question

What is a good invisible captcha? My site requires JavaScript so anything which requires that is fine.

Answer 1

I've used the technique of a Display:None text box, and rejecting any submission that fills it in and had pretty good luck with that.

Answer 2

Here's a simple math captcha by Phil Haack. It even works with javascript disabled.

In his own words:

The way it works is that it renders some javascript to perform a really simple calculation and write the answer into a hidden text field using javascript. When the user submits the form, we take the submitted value from the hidden form field, combine it with a secret salt value, and then hash the whole thing together. We then compare this value with the hash of the expected answer, which is stored in a hidden form field base64 encoded. If javascript is disabled, then we render out the question as text alongside a visible text field, thus giving users reading your site via non-javascript browsers a chance to comment.

Answer 3

Read the answer here:

http://stackoverflow.com/questions/450835/how-do-you-stop-scripters-from-slamming-your-website-hundreds-of-times-a-second

And this question is not System admin related. The better place to ask would have been stackoverflow.com

Answer 4

Add a new input field, label it "Please leave blank", hide it using CSS, and ignore the post if that field is filled in. Something like this:

<style type='text/css'>
#other_email_label, #other_email {
    display: none;
}
</style>
...
<form action='mail'>
<label id='other_email_label' for='other_email'>Please leave blank:</label>
<input type='text' name='other_email' id='other_email'>
...
</form>

So a human being won't see that field (unless they have CSS turned off, in which case they'll see the label and leave it blank) but a spam robot will fill it in. Any post with that field populated must be from a spam robot.

Answer 5

If you mean - use captcha that a human can't see as a human validation test - i think it's impossible.

This way a robot ignoring the captcha will pass for a real person! Seems like a trap for a naive spam robot.

If you want your captcha-protected site to work with clients that have no javascript - then you should hardcode it into html.

Also, if you can reliably identify trusted users (either by judgment call or by detecting some usage pattern) - you can let them post to your site without captcha.