I'm not sure that a captcha should be considered part of your authorisation, identification or security framework. A captcha is just attempting to block out rob

I'm not sure that a captcha should be considered part of your authorisation, identification or security framework. A captcha is just attempting to block out robots - it doesn't help you identify if a human user is who he says he is, or has the authorisation he says he has. No captcha is 100%. And they are trivial to break using human drones in India or China who solve hundreds an hour. That said, the best, and clear market leader in captcha technology is reCaptcha, now owned by Google (they paid $100m for it) http://www.google.com/recaptcha http://www.google.com/recaptcha