HTML Encoded Captchas

rangeva writes to tell us about a twist he has developed on the common Captcha technique to discourage spam bots: HECs encode the Captcha image into HTML, thus presenting an unsolved challenge to the bots' programmers. From the writeup: "The Captcha is no longer an image and therefore not a resource they can download and process. The owner of the site can change the properties of the Captcha's HTML, making it unique,... add[ing] another layer of complication for the bot to crack." HECs are not exactly lightweight — the one on the linked page weighs in at 218K — but this GPL'd project seems like a nice advance on the state of the art.

Comments

Re:A captcha is still a captcha

[Joebert]

A HTML generated captcha would prevent that, since there is no image file to copy.

Someone could go to Microsoft.com & download Visual C++ Express Edition for free & put together somthing that uses Internet Explorer to render the entire page & save a bitmap of it in less than a day.
If they already had somthing to recognise a CAPTCHA, I bet they could dig the CAPTCHA image out of that bitmap while they're there.