CAPTCHAs have a lot of downsides, accessibility and user friendliness are two things that are often sacrificed.
I've thought of an idea that might work really well, has this ever been attempted before?
The prerequisite for it is that email verification must be a requirement on your website, which is currently very common.
- User/robot signs up
- User/robot notified that email verification is required
- Email dispatched in HTML format
Verification Link in Email
The email link will include the verification link. For the example, I've given the link 3 querystring parameters:
- UID - ID of user registering
- Code - Unique code for activation
- F - Fail flag
It will render as follows:
But the HTML in the email is as follows:
Thank you for registering!<br /><br /> To activate your account, please click on the link below:<br /><br /> <a href="http://www.example.com?UID=27&Code=GR452AF&F=1">h</a><a href="http://www.example.com?UID=27&Code=GR452AF&F=2">ttp://www.example.com/Verify</a> <br /><br /> Regards<br /> Tom
The assumption here, is that the robot will either click the fail link as it's first in the email, or it will click both links.
- If both links are clicked, we can mark them as a potential bot.
- If only the first link is clicked, we can mark them as a potential bot
- If the second link is the only one clicked, we can assume they are a legitimate user
- HTML emails for client must be enabled or it will be very confusing for the end client
- A small % of clicks in the honey pot area of links (however, you could probably hide this H link with some more HTML, but that risks confusing end users depending on how you approach this so I wouldn't try)
- It's not a binary pass/fail. If the fail link is clicked, then you can manually review the account, or resend an activation link.
- It's accessible (as long as the client enables HTML email)
- It's non interruptive for user friendliness, the flow for the user is natural and they wont know they've just passed a CAPTCHA test
If this method has a lower false positive rate than traditional methods, it's worth having. Not only that, but it's an invisible verification process from the genuine users point of view.
Thoughts? Criticisms? Has this been done before?