Sorry, but no, they don’t.
Captchas render content inaccessible to blind users or anybody that uses a screen reader system. If you’re a US company, this is potentially an ADA violation and could get you sued.
Most captchas are easily defeated by clever software. I forget the link, but some university students wrote a program that reads captchas and gets it correct something like 80% of the time. If they had their program try a second time (with different generated captchas from the same programs), that increased to 95%. It was on slashdot a year or two ago. Interesting stuff.
A surprising amount of captcha software is buggy anyway. Either encoding the captcha text in a cookie or in some other easily machine decodable form, or using a hash, which makes the process of machine reading a hell of a lot easier.
Since captchas are reasonably difficult to code, the majority of them use pre-made packages, so all the software has to do is to determine what package you use and use the correct algorithim to defeat that package.
One attack used other people to defeat captchas. Essentially, he made human beings type in the text from a captcha to access something, like porn. Only the captcha image was relayed from somebody else’s site and the text then would let the software get through that captcha. An interesting attack, I thought. All a spammer would have to do is to send any captchas to some high traffic he ran, like a free porn site.
And so on. The point is that captchas don’t work in the long run. Nor will they ever, because as processor power increases so does the ability for machines to read and defeat them.
Whereas filtering solutions *do* work, and work quite well.
