I think an animated GIF would be better for client side support, and isn’t technically difficult to dynamically generate. The downside is that it does take significantly more processing time than static graphics to generate, and for captchas on popular websites dynamic generation is usually the only viable route (since otherwise the attackers can just harvest all of the images, and create a database of hashes from the file and associated text).

Flash is definitely and easier route in terms of server resources, but you are absolutely right about it being a pain with the myriad of flash versions (is flash even present, is it a smart device that uses flash-lite, etc).

Yeah, I read that article on ars yesterday. I’ve found that no more spam than usual has made it through my outlook filter (the built in filter in 2007 is remarkably good) but I have been getting a great deal more spam in my gmail account, from gmail and hotmail domains.

I’ve also seen the Asira project before and I like the intent of it. That said, I have a concern with it. It is technically feasible to crawl petfinder and download all of the images, which are conveniently categorized by type (cat, dog, bird, rabbit, etc) and then create a simple database that uses a hash from the image as a key to look up the type. Then, when crawling sites that are asira enabled the images could just be rehashed and looked up.

Hopefully MS is actually doing some modifications (resize, slight color filter, etc) that would cause the Asira image to have a different hash value, which would frustrate that approach.