<pflenker>’s top level post makes a good point here, suggesting that because untargeted bots are your biggest concern, even the simplest custom challenges tend to work quite well (e.g. “enter the number 123 in the last box”) — with ”custom” being the key here!

Because: Until large strides are made in artificial general intelligence [1], simple little challenges that are creatively designed will be very difficult for a single general-purpose AI system to crack 100% automatically.

In contrast, if your site is targeted with actual human engineers trying to crack your anti-bot system, there’s a good chance they’ll succeed no matter how strong your system [2]. In the case of such targeted attacks, presumably your company will be so important and successful that you’ll be able to afford similarly expensive resources to defend from such attacks.

[1] Don’t get me wrong, I’m not doubting that sufficiently general AI is coming that can easily solve such challenges. But for now, to get your startup off the ground, this is apparently an effective short term solution that is very easy to implement.

[2] Human-operated “sign up farms” are definitely a thing, in addition to actual human-operated spam / advertising / propaganda farms (imagine a typical “call center”-style office hired to do this).

Can't remember where I saw this, but someone else talked about creating a field in the form, hidden by CSS, that if filled in would just discard that submission. Should work for most automated bots that aren't specifically targeting you.

This is known as the honeypot technique, it's quite old and I'd say that most spam bots go defeat it easily enough already.

You may want to consider running some proof-of-work in the browser, that would be costly to run for bots.

That's not a bad idea.

I'd be concerned about being accused of/blocked for crypto-jacking. That said, I'd like to see a proof-of-work based captcha that donates any earnings to charity as cryptocurrency.

I came across hashcash.io before, previous discussion: https://news.ycombinator.com/item?id=7944540

Alternatively I could write something dead simple from scratch that looks for sha collisions to burn a few cycles. Would this be less dubious?

All that does is further penalize the victims of botnets by driving up their electricity bills. It won't hurt the spammers who run the botnets.

This is only true if we assume that spammers are not already saturating the resources of their victims. And even then, it's better than penalizing blind or deaf people.