Building a Honeypot

CAPTCHAs are evil. You can still stop bots, but do so in an accessible way. This brief talk will show you how.

Transcript

1. Building a Honeypot Jason Crome Copyright 2019, Jason A. Crome
2. What’s a Honeypot? • Wikipedia: “…a computer security mechanism set to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems.” • In this case, we are deflecting the attempts of a bot to stuff our contact form full of bogus information. • Sounds like a CAPTCHA, right? Copyright 2019, Jason A. Crome
3. So why not a CAPTCHA? Copyright 2019, Jason A. Crome
4. So why not a CAPTCHA? • Not accessible • Easily spoofed • Newer CAPTCHAs use machine learning to determine if you’re a bot Copyright 2019, Jason A. Crome
5. Why use a honeypot? • Puts the burden on the bot, not on the user • Less annoying • More accessible Copyright 2019, Jason A. Crome
6. How to Implement • Create two hidden form fields: one is type hidden, the other is hidden with CSS • User never sees either one, but most bots will • If either filled in, act accordingly Copyright 2019, Jason A. Crome
7. SHOW ME THE CODE! Copyright 2019, Jason A. Crome http://advent.perldancer.org/2018/21
8. Working Example https://crome-plated.com/contact Copyright 2019, Jason A. Crome
9. Questions? Copyright 2019, Jason A. Crome
10. Thank you! Copyright 2019, Jason A. Crome