What is a good invisible captcha?

Question

What is a good invisible captcha? My site requires JavaScript so anything which requires that is fine.

Answer 1

Add a new input field, label it "Please leave blank", hide it using CSS, and ignore the post if that field is filled in. Something like this:

<style type='text/css'>
#other_email_label, #other_email {
    display: none;
}
</style>
...
<form action='mail'>
<label id='other_email_label' for='other_email'>Please leave blank:</label>
<input type='text' name='other_email' id='other_email'>
...
</form>

So a human being won't see that field (unless they have CSS turned off, in which case they'll see the label and leave it blank) but a spam robot will fill it in. Any post with that field populated must be from a spam robot.

Answer 2

Here's a simple math captcha by Phil Haack. It even works with javascript disabled.

In his own words:

The way it works is that it renders some javascript to perform a really simple calculation and write the answer into a hidden text field using javascript. When the user submits the form, we take the submitted value from the hidden form field, combine it with a secret salt value, and then hash the whole thing together. We then compare this value with the hash of the expected answer, which is stored in a hidden form field base64 encoded. If javascript is disabled, then we render out the question as text alongside a visible text field, thus giving users reading your site via non-javascript browsers a chance to comment.

Answer 3

I've used the technique of a Display:None text box, and rejecting any submission that fills it in and had pretty good luck with that.

Answer 4

For what it's worth Google is rolling out 'Invisible ReCAPTCHA' (https://www.google.com/recaptcha/intro/comingsoon/invisible.html), I already got whitelisted with my site. At the moment implementing it, however the docs aren't that elaborated...:)

Answer 5

MTCaptcha is a reCaptcha alternative captcha service that supports invisible captchas similar to the recently launched reCaptcha V3, where its invisible to most users but shows a captcha if it feels the traffic is risky.

Answer 6

If you mean - use captcha that a human can't see as a human validation test - i think it's impossible.

This way a robot ignoring the captcha will pass for a real person! Seems like a trap for a naive spam robot.

If you want your captcha-protected site to work with clients that have no javascript - then you should hardcode it into html.

Also, if you can reliably identify trusted users (either by judgment call or by detecting some usage pattern) - you can let them post to your site without captcha.