Mailchimp的“验证码”验证如何工作？

Question

Here is the snippet of code I am referring to:

<!-- real people should not fill this in and expect good things - do not remove this or risk form bot signups-->
  <div style="position: absolute; left: -5000px;">
    <input type="text" name="[IDENTIFYING CODE HERE]" value="">
  </div>

The form is then sent off to their site where JavaScript (jQuery) validation takes place.

    <script type="text/javascript" src="http://downloads.mailchimp.com/js/jquery.mailcheck.min.js"></script>
<script type="text/javascript">
    $(document).ready(function(){
        try {
        var domains =['hp.com','hotmail.co.uk','yahoo.co.uk','yahoo.com.tw','yahoo.com.au','yahoo.com.mx','gmail.com','hotmail.com','yahoo.com','aol.com','comcast.net','msn.com','seznam.cz','sbcglobal.net','live.com','bellsouth.net','hotmail.fr','verizon.net','mail.ru','btinternet.com','cox.net','yahoo.com.br','bigpond.com','att.net','yahoo.fr','mac.com','ymail.com','googlemail.com','earthlink.net','xtra.co.nz','me.com','yahoo.gr','walla.com','yahoo.es','charter.net','shaw.ca','live.nl','yahoo.ca','orange.fr','optonline.net','gmx.de','wanadoo.fr','optusnet.com.au','rogers.com','web.de','ntlworld.com','juno.com','yahoo.com.sg','rocketmail.com','yandex.ru','yahoo.co.in','centrum.cz','live.co.uk','sympatico.ca','libero.it','walla.co.il','bigpond.net.au','yahoo.com.hk','ig.com.br','live.com.au','free.fr','sky.com','uol.com.br','abv.bg','live.fr','terra.com.br','hotmail.it','tiscali.co.uk','rediffmail.com','aim.com','blueyonder.co.uk','telus.net','bol.com.br','hotmail.es','email.cz','windowslive.com','talktalk.net','home.nl','t-online.de','yahoo.de','telenet.be','163.com','embarqmail.com','windstream.net','roadrunner.com','bluewin.ch','skynet.be','laposte.net','yahoo.it','qq.com','live.dk','planet.nl','hetnet.nl','gmx.net','mindspring.com','rambler.ru','iinet.net.au','eircom.net','yahoo.com.ar','wp.pl','mail.com','emmis.com','hotmail.de','lireo.com','gmx.at','ukr.net','zol.co.zw'];
        var tdomains = [];
        $('#MERGE0').on('blur', function() {
          $(this).mailcheck({
            domains: domains,
            topLevelDomains: tdomains,
            suggested: function(element, suggestion) {
                var msg = 'Hmm, did you mean '+suggestion.full+'?';
                if ( $('#MERGE0_mailcheck').length > 0 ){
                    $('#MERGE0_mailcheck').html(msg);
                } else {
                    element.after('<div id="MERGE0_mailcheck" class="errorText">'+msg+'</div>');
                }
            },
            empty: function(element) {
                if ( $('#MERGE0_mailcheck').length > 0 ){
                    $('#MERGE0_mailcheck').remove();
                }
              return;
            }
          });
        });
        } catch(e){ console.log(e); }
    });
</script>

---

In laymen's terms how does this "captcha" work?

What prevents a bot from recognizing this and skipping that field?

What prevents a person from accidentally tabbing into that field and entering something?

Unless I am missing something this seems like it wouldn't be very effective, however it seems to be working?

Answer 1

What prevents a bot from recognizing this and skipping that field? What prevents a person from accidentally tabbing into that field and entering something?

Nothing, and some will.

It will however continue to be as effective as any other honeypot (this is a honeypot, not a captcha). No one spam prevention method is the end-all solution to spam prevention. This is just one method that can and should be combined with others. This particular method prevents the bot from skipping the form (assuming the input gets a new name every time) and forces the bot to identify that field as a honey pot in order to successfully complete the form. It should be pretty effective against most spider spam, but if someone really wanted to use it to cause spam it can be beaten.