   From: Gez Lemon <gez.lemon@gmail.com> Date: Wed, 18 Jul 2007
20:35:59 +0100 Message-ID:
<e2a28a920707181235j28b5351fxc785251074ef6d50@mail.gmail.com>
To: "Ben Maurer" <bmaurer@andrew.cmu.edu>  > Once a user solves
a specific CAPTCHA, they can not be allowed to use the > CAPTCHA
again. Otherwise you could amplify a human based attack by > re-
using human solutions. It's not that the code can't be done,
however > getting the security aspect of it right is a bit
harder.  The usability aspects make it worth the extra work to
getting the security aspect right, in my opinion. At the moment,
AOL do re-present the same CAPTCHA, so if they're not safe-
guarding against this right now, it's something they will need
to address.  > Also -- it's a lot easier to just validate in JS
on the client side. Then > on the server side you only need to
validate for non-js clients (and to > protect against evil
users). In this case, having the "hide the CAPTCHA" >
functionality would be unnecessary.  That would depend on how
the er