Most forums have flood control, yes, that’s why I wasn’t talking about time between posts (which is, as you said, impossible due to not having a real user database) but only about time used to write a post.

“I would have to write the current time into a hidden field, which of course could be faked easily.” Yep, exactly my thoughts, which is why I said “communicating the first timestamp to the submit page” would be problematic. Good to see you understood my thoughts there :)

The only way to send along a timestamp would be by obscuring the data. Something I’m not a big fan of but which should stop spammers anyway. With spam it’s about as many posts in as short time as possible. For example, you could actually dress up the timestamp as an email address inside your honeypot after appending a control number. Any value in the honeypot that can’t be turned back into a timestamp with a matching control can be assumed coming from a bot and will be stopped. If the bot was too smart to fall for the honeypot you will move on to checking the timestamp. If the bot just pasted a lot of text but submitted within 10 seconds it can be stopped again.

This would be unique enough to stop a lot of spam. Only two types of bots will now go through. The first are those perfectly emulating human behaviour (reply times) while also being smart enough not to fill in all fields. The second are those that will reverse engineer the timestamp and spoof it, these are less than 1% of all spam bots because it involves developing spamming software specifically for targeting these forums.

Both these cases will be almost impossible to stop with your (as of yet) undisclosed new trick too. The first would include running in virtual browsers to fake human behaviour and the second would simply be updated again.

(It’s fun to think about ways to trick computers. It’s a good thing we’re not up against Watson here! :D)

Looking forward to see this new trick of yours pop-up on GitHub.