Originally Posted By: wfaulk
Originally Posted By: hybrid8
I'm lead to believe the only thing it tests for is a valid javascript interpreter in the client browser. And that this test would fail if a spammer were using some script-only connection method to your web host.

Assuming that the spammer's client had a working javascript interpreter, yes.



The spam script doesn't even need a javascript interpreter. All it really tests for is the ability to calculate sha-1 hashes. The spam script can easily parse the seed for the hashes out of the javascript file.