I had a similar idea once. The key is that you need to add a cost to signing up on a site. If you make the cost be paid in time that will tend to deter normal u

I had a similar idea once. The key is that you need to add a cost to signing up on a site. If you make the cost be paid in time that will tend to deter normal users. The correct deterrent, I feel, is CPU cycles. Light browsers/users have plenty of them, a spammer needs all he can get. The idea would be to pair a CAPTCHA test that a human can do well on with a compute-intensive task that really only a computer can do (like solving a big discrete log). An implementation would be to have the user type in the specific values (which are given in CAPTCHA form) into an on-page javascript calculator. This will then take some time to solve the equation (which can be easily adjusted by the size of the discrete log). If a spammer uses humans to bypass the image recognition task, they'll still have to spend CPU time to solve the equation. Likewise, cracking the CAPTCHA with OCR will not circumvent the computation. If too many successful spam logins are still occurring the difficulty of the compute task and or the OCR task can be adjusted.