Will that work? For some reason, I guessed the YouTube video URL was a function of the first two or three bytes of your IPv4 address, to prevent exactly this c

Will that work? For some reason, I guessed the YouTube video URL was a function of the first two or three bytes of your IPv4 address, to prevent exactly this case. I did something like that back when I designed a CAPTCHA system for LimeWire. (The LimeWire website only ran PHP (soft requirement), the credit card processing box only ran Perl (hard requirement), no shared network drive between website and credit card box (hard requirement), so none of the existing Open Source CAPTCHA implementations worked. So, I made the CAPTCHA answer a cryptographic function of a shared secret, the user's /24 network, and a user-supplied timestamp rounded to a 32 or 64-second boundary. Timestamps older than 15 minutes were rejected, and messing with the timestamp would mean that the captcha answer wouldn't match the image you were given. I watched an attacker solve a CAPTCHA for an IP in Virginia and a couple seconds later try replaying it thousands of times from an IP in England. A few IP addresses for US navy satellite ground stations in Virginia (NAT for tons of deployed sailors) had to be white-listed from the replay checker.)