Solving that test is indeed pretty simple, I think its O(n^2) give or take. Even if it was n^3 the value of n is so low it isn't restrictive. The benefit is tha

Solving that test is indeed pretty simple, I think its O(n^2) give or take. Even if it was n^3 the value of n is so low it isn't restrictive. The benefit is that it is relatively uncommon (not being targeted), and it is more difficult than the average captcha (less likely to be targeted). It is also resistant to brute force (many captchas have the answer to them included in the question, this one requires some parsing and solving, not simply trying words near the captcha randomly). This captcha is not perfect, but I think it is better than most current captchas, and it is deliver neutral (doesn't penalize the impaired). Thus it seems like a step in the right direction, but is not a final destination by any means. By non-consistent UI I mean breaking the "Name, Email, Webpage, Body" paradigm. I think a good (although certainly harder to implement) example of this is http://www.djangobook.com/en/beta/chapter01/ http://www.djangobook.com/en/beta/chapter01/ . If you click on the little tabs/indexes on the side of the page a little comment box pops up that is relevant to the specific position. This UI is sufficiently different from a standard commenting system that a standard form filling spambot would be clueless. This is only an example, but perhaps it helps explain my idea of diversifying a bit. Other types of spam bots would not be affected, but perhaps similar changes would make them less effective as well (your example of using Ajax is a good possible example).