I like the basic idea of having a catchpa generation and verification service, but I'm not a big fan of letting domino do too much without having a way to customize it to look the way I want. So how would this work?

How about a new design element "CAPTCHA" that would allow you to specify what images/questions to use along with customizable messages? I haven't worked out the details but something like the third screen shot?

What about the option of implementing a math-based thing like on Mary Beth's blog, where it asks you to solve a simple math problem? That's a lot better for users who have vision problems and thus cannot read the warped image in the CAPTCHA.

@3 - I agree... that's why I suggested allowing images or questions but there should/could be that third alternative as well.

I was thinking more along the lines of a service that would:
- Generate CATCHPA tests (image, audio, question) & answers
- Generate unique IDs for tests
- Match IDs to answers, i.e. respond true when answer for an ID is correct.
- Disallow repeat attempts for a given ID

We then need a way to actually use the service. Preferably something simple if you want live with domino's native output (shudder!), with a more fundamental way if you want to get fine grained control.

Way too many not accessible, not secure captchas on this planet anyway. Don't make it even easier to have them on each and every form, without further thinking, please.

Ditto Harkpabst's comments. This is also something that is doable in Domino today, though with a bit of work.

@5 ... Can you expand on this idea. I'd like to know if you have done anything like this to stop form spammers currently.

@6... So besides making generalities about current CAPTCHA's and without further thought you added nothing of value to this idea when you demoted it. How about next time you demote, you put some thought into how to improve the idea, or come up with a different solution. Maybe you don't have to worry about these things because you don't have public facing websites. I do and I'm looking for a way to handle the gazillion form spammers out there. If CAPTCHA's don't work, what in your opinion does?

@6, @7 ... how do you handle web form spammers??? I've done stuff to address this in my apps but it is NOT easy nor is it intuitive and requires a lot of work and effort to create. If there is an easy way to implement this, why have everyone keep re-inventing the wheel.

@0 ... You should feel pretty lucky (more lucky then most idea posters) to even get a comment along with a demote at all, don't you think? Neither is it required to comment on a bad idea, nor am I responsible for improving on it. If you don't see the value in a comment immediately, well ... bad luck for you.

So, don't be in a huff, have a quick peek at Wikipedia (or other sources) and consider the downsides of captchas. Just to name the big points:

Accessibility:
It's pointless to let the designer decide, whether he wants to display a graphical capture or a math calculation or some other kind of question. You always need an accessible option.

Ease of use:
Any approach that would leave you as the designer with the task of creating captcha graphics before you can use them looks tedious to me. Managing a list of questions or math calculations in design elements instead of configuration documents looks like a constraint to me. Plus, it will potentially keep the app responsible from updating them on a regular basis.

Security:
Even taking aside more advanced hacking techniques (like displaying your captchas on "honeypot" sites and having human beings "cracking" them without even knowing so): There's a fine balance to be found between a captcha being either too easy to crack by software or too hard to decipher for human users. And this is no constant. Do you want to keep up with the latest progress of hackers all the time? If anything, some kind of service that we can consume in our applications - as suggested by Kerr - could deal with those problems in a reasonable matter. And it would require a solid trust base, of course.

From my experience, doing just the simple things (like checking the referrer and so on) are well appropriate to filter out the majority of form spam. Yes, better bots can spoof that, but most simply don't attempt to. If you feel like you need more protection, consider "negative captchas", as suggested by Damien Katz (although I'm not sure off hands, if it was his own idea). If you still want more, go ahead and implement whatever captcha technique you want, but leave me alone with a new design element for it.

N.B.: When signing up for a Microsoft LiveID (or however they call that), your are presented with an alternative "acoustic captcha". Now that was fun for our whole office ...