great idea, i can see this being much easier than some crazy captcha

Are you planning to send this data back to the server at any point? In that case, the bot can simply change that when it sends the request to the server. Any variable value can be spoofed.

Well the way we get around that is to create a random variable name. And store the name server side so we know what to expect when it comes back.

But won't the random variable name still have to show up in the web page's code? And in that case, wouldn't a bot still be able to read it?

Good point. I thought about this a bit more and it seems that one way would be to use AJAX on the form page to send the mouse movement directly to the server. We can then perform the calculations there.

Sorry to keep playing the Devil's advocate here, but the problem with using Ajax is that it's still just another HTTP request sent to some url on the server. This request, and any data sent with it, can be forged by a scripted bot.

Here's an idea, you could have a box or two that randomly change position. The positions of these boxes are stored on the server. The user has to click each box, and the mouse coordinates for each click are sent to the server and compared to the stored positions. The code to set the position in the browser could be obfuscated so that bots can't read it.

Thats a good idea. Although the point of detecting the mouse is to keep it transparent to the user without creating any extra steps. A variation of your idea which would make it simple is to have a moving submit button based on your idea except there would only be one button and it is an actual step in the form. For instance the submit button below this textarea could move anywhere from extreme left to extreme right. And possibly up or down a bit, without throwing off the design too much. I like the idea.

I like the idea, the last comment I think is on to some thing. if you have a submit button placed "randomly" (with in reason) in your design, and you tell the user they can only submit by clicking on the button with a mouse (good / bad? for usability? not every one uses a mouse). than you could just grab the mouse x/y position check it against the position of the button. a bot should not be able to copy this or?

I also like the idea, but I'm concerned about keyboard accessibility...I do use a mouse, but having gotten used to doing most of my work at a command line, I find it much faster to just learn the keyboard shortcuts and navigate that way. I know I am not in the majority as far as that goes, I just wanted to put my 2c in.

Anyone interested in seeing some javascript implemented with a focus on mouse movement activity, check out this jQuery plugin: http://cherne.net/brian/resources/jquery.hoverIntent.html Hope this helps :)