Quote from: DooMAD on August 15, 2018, 12:58:15 PM

I found it best to completely avoid any of the established captcha providers. Back when I used to run a phpBB, I had a little-known visual captcha called KittenAuth. It basically gave you 9 pictures in a 3x3 grid and the default setting was to select only the kittens. But you could change the pictures to something more thematically appropriate for your site. I found that far more effective than any other captcha I've ever encountered. Only human beings got through after that.

The safest bet is to make a totally proprietary one. The more obscure, the better.

I don't how long ago this was but captcha solving has really moved on in just the last 4 or 5 months I've been involved with trying to fight bots. Something like that with a 3x3 grid they would just brute force like they do with reCAPTCHA. There's only a certain number of combinations and they have a powerful backend server just trying until it gets a token to pass to a worker bot.

Back to the matter in hand we already know that these spambots can log in, so they must already have the ability to solve reCAPTHCHA so asking them to do it again to post will not make any difference to them. They just need to add a couple of lines to their script.

The bottom line is if there is a financial incentive to do so someone will find a way to defeat any type of captcha.