This reminds me of how the best spam prevention methods involve making your site's registration system different enough from everyone else's that bots can't fil

This reminds me of how the best spam prevention methods involve making your site's registration system different enough from everyone else's that bots can't fill in the forms automatically. Yeah, it's useless against a dedicated attacker that can write a program specifically to attack your site, but it makes common automated systems useless, and (if done by enough people overall) makes the act of posting spam more expensive overall. You could probably say the same thing here. Yeah it won't work against an attacker who knows what they're doing, and no, it'll never work as your only or main line of security. But it'd probably slow down or stop attacks by random script kiddies using bots bought from dodgy internet forums or what not. And those are a decent percentage of attacks a site or service receives now.