One thing that's occurred to me -- there's obviously an asymmetry of effort in captchas. Reliable proof that someone is human is very hard. What about reliable proof that something is not human, but an automaton? Can we make this stronger, and make it reliable proof that something is a particular automaton?
It seems to me, the answer is Yes. This is actually very powerful and useful for security. (Even if you can only count on the first time it's answered.)
Requiring that people access your site over TCP/IP is a reasonably good way to weed out clients that don't involve computers at all.
Bots are user agents that don't have a human operator; browsers are user agents with a human operator. Both bots and browsers involve computers. However, as browsers can automate some tasks, and bots need human interaction at least to program them in the first place, there is a blurry line between bot and browser. CAPTCHAs try to force a certain amount of human interaction. The only reliable way to prevent human interaction between sending a request to and receiving a response from an unknown user agent is to require a response so fast as to preclude human intervention.
It seems to me, the answer is Yes. This is actually very powerful and useful for security. (Even if you can only count on the first time it's answered.)