I work in medical IT. You'd be surprised how many <i>government</i> sites do similar.<p>An example would be <a href="https://sso.state.mi.us/som/dch/enroll/reg_page1.jsp" rel="nofollow">https://sso.state.mi.us/som/dch/enroll/reg_page1.jsp</a> (You can enter any fake name/email, this is only step one of the registration script. The next page has the captch in question.)<p>The captcha is plaintext, right on the page. The data from the captcha isn't even sent to the server, it is processed <i>locally</i> via JavaScript.<p>So, the bots don't even have to do anything, but humans have to input a meaningless number...<p><pre><code> <input type="text" name="inputNumber" class="entry-field" size="5" tabindex="3">
<!-- ... -->
document.write('<div id="layerNum" class="verifyNumber" align="center">');
document.write('<b>'+str+'</b>');
document.write('<img src="generateGIF.jsp?number='+str+'">');
document.write('</div>');
document.write('<input size="5" type="hidden" name="rdNumber" value="'+str+'">');
<!-- ... -->
<input type="submit" value="Continue" name="submit" onclick="return Valid();">
<!-- ... -->
function Valid(){
// ...
if(chkRandomNumber()){
return true;
}else{
return false;
}
// ...
}
function chkRandomNumber(){
str1=document.all.rdNumber.value;
str2=document.all.inputNumber.value;
if(str1!=str2){
alert("Please check and type the number as shown in the box");
return false;
}else{
return true;
}
}</code></pre>