If there are indeed large amounts of captchas solved and sold by people in India, then rotating images like Google is trying and otherwise updating the technique is pointless. You couldn't even get a few more years out of it, because it isn't a bot being tested. Nor would the gender or naked person identification work.

The behavior thing seems like a good route.

The behavior thing is awesome (the navigation pattern route suggested by the author). I am willing to bet that, if it were possible, capturing and analyzing the navigation patterns on any given website would lead to better design and even capture some user data that could be extrapolated (eg, my mother tends to navigate web pages differently than my much younger brother).

In any case, I can't tell you how many times I've gotten those damn captchas wrong. Makes me feel like an idiot...

If we are using a behavior analysis technique for telling humans and computers apart to prevent people from spamming, how is this going to stop Indians or any other human from entering the data? The only way to do that is to check for bot-like behavior from a human.

That's a good point, eBob. There are many ways such a plan could be implemented, and one solution might simply require that the user interact with a page long enough--and in a certain matter--that it is very likely that he or she is human. Anything that significantly slows down the manual Captcha solvers would do a great deal to deter them.

The only way to stop the Indians is to increase the time cost until it is no longer profitable for a spammer to hire the Indians. Remember, the Indians must be paid. Ditto for using unemployed Americans, young children, etc.. They may not cost much, but they still cost. The spammer is a businessman, and is expecting a return on his investment. The cost of farming the captchas out to India for solution has to be much less than the return from that variety of spam, or it won't be done. What fraction of spam results on a sale being made? What is the profit margin?

Also, IMHO the best way to kill at least half the spam out there is to allow sexual performance drugs like Viagra to be sold over the counter. At least 90% of all e-mail spam is ads for drugs. Most web spam is for dating and porno sites, and is best inhibited by captchas.

if you try to deter spammers by "time cost", then you are also incurring that time cost on your legitimate users. That will be unacceptable for most. the solution cannot actively drive users away, which any truly lengthy (more than a few seconds) process will do.