This is nearly a good idea, except that by adding a random string and hashing it a few times, you can get an image that is approximately the same. Its might be

This is nearly a good idea, except that by adding a random string and hashing it a few times, you can get an image that is approximately the same. Its might be reasonable to assume the NSA gets 100,000 to 1,000,000 attempts at low expense, of which at least a few hundred will be a similar color, and one of those will have a similar-enough pattern that people are less likely to notice. It does create another level of protection for the user, and another hurdle for the attacker, but it still requires user diligence.