FYI: Captchas are generally considered "broken" at between 1% and 10% rates of success with automated approaches, because attackers can run hundreds of thousands of requests, generally "for free" at the margin. There is no practical difference in the amount of abuse suffered by a site with a 90% captcha and a 9% captcha -- the first one just requires 10X as many HTTP requests to abuse.<p>This is one of the unfortunate "math favors the bad guy" consequences in a lot of anti-abuse filtering tasks. (Anti-spam research has similar problems, which is why the main innovation wasn't making filters better but radically increasing the cost of getting caught, via burning the reputation of the offending IP. IP addresses are a lot more expensive to acquire in quantity than packets.)