Coding Horror had an interesting piece on how CAPTCHA is broken. We all knew this.
Granted, CAPTCHA is very hard to break from a computer’s point of view, but it is also very hard to break from a human’s point of view. (see the image below, can you decipher it?) The more difficult CAPTCHA becomes for computers, the more difficult it becomes for humans. There are numerous times where I will not buy from a website because of the horrible CAPTCHA implementation.

Alternatives? How about questions! There are certain tasks computers fail at doing better than humans. Anything that a human can understand or interpret better than a computer will be a better safeguard.
On one of my websites I use random questions to perform verification. The problem with CAPTCHA is that the hacker knows he has to type into the box whatever is in the image. If you add a human only element, where the user has to understand and/or interpret a question, then it makes it infinitely harder to break. If you’re Ticketmaster, and using the English site in the US, you could ask a question such as: “We live in the _____ States of America” or something similar. As long as the users can spell “United” they can move on. What if, you say, the user cannot spell it? Well, chances are if they cannot spell it or know the answer, they won’t get the impossible CAPTCHA image either. Obviously hackers will compromise that question because they’ll get the answer and program it into their scripts, but if you have a database of questions large enough (say 5000 questions) each dynamically generated when you load the page, the likelihood of answering the question correctly is slim. Even knowing all the answers to all the questions is slim too! By having different methods of answering such as blanks, checkboxes, radio buttons, etc, it makes it more difficult. If the question is: “type cat with an ’s’ after the ‘t’ into the box below” it will fool any script UNTIL the hacker finds a pattern in the question or the answer to the question. Website’s CAPTCHA implementation is static based on an algorithm for image or text manipulation. Once it is broken, attackers can defeat the safeguard quickly and easily. Make the questions random and the database of questions large enough and you won’t have as big a problem. When we had the standard vBulletin CAPTCHA installed we got 100s of spam users/posts a day, once I implemented a few hundred random questions I haven’t got a single spam user (other than a REAL person) in almost 6 months. There are/will be some flaws, the questions themselves may be too difficult for people to answer, but considering the sad state of CAPTCHA as it is, when 50% of people can’t get the damn thing right, the questions aren’t such a bad idea.
Another idea is “Hot Captcha” which is a website that has photos of women on it. As the user you are supposed to choose the 3 ‘hottest’ women based on a popular culture criteria. The split is very obvious to a human, like comparing a monkey to Angelina Jolie, but not so obvious to a computer. This particular method would never actually work due to the nature of the images being analyzed, but the principle is there. Have simple objects and have the user identify them (square, circle, tree, kitten, etc).