Well, and what about this?
Looks like a big library of images with associated metadata to me ;P

I have a feeling that most accounts here average less than 10 games purchased. I know for me I wouldn't recognize many of the covers.

edit: I recall one of the Top 10 webcomic websites tried that with character icons. Few folks could get past it since they didn;t read every single webcomic out there.

But GOG has another useful piece of data handy: the list of games in the user’s library. So they could ask you to name a game coming from your list of owned games or something like this.

A fairly small library of images though, say there are on average 16 images per game and 2500 games, that's 40000 images, I would assume you'd want a couple orders of magnitude more than that, as well as create enough new images and switch out old ones every so often in order to make storing correct answers less effective.

Sure, they could show part of a screenshot and ask stuff like "what company developed this game?" and "what year was this game released?" because that's roughly what they have, but they'd need quite a different set of metadata for questions like "which of these images contain a group of at least two gnolls?" and "where in this image is the skeleton?".

The former is a fuckload more annoying than the latter to get through unless you already have encyclopaedic knowledge of gaming (personally, at least, I would prefer not to have to visit Wikipedia in order to log in to GOG, and that doesn't even include identifying the game), and the latter requires a fuckload of work to set up.

As you say, it's just one technical solution.

In case of self-redeem of a code already tied to account: two-way authorization works. Just send me a bloody e-mail with a temporary confirmation link. Game's added to the account's library anyway, not sure what any unauthorized person could do with that - even assuming they have access to the account's e-mail. Which is something that's on me, not GOG.

It's more problematic for gift codes, but somebody already mentioned Chinese GOG users have different technique in place due to Google being blocked by the Great Firewall.

I don't care if CAPTCHA remains as an option to people who don't care, either. You can give me something cumbersome (as long as it works) as an alternative, and I'll use - as long as it's hosted by GOG and not dependent on some "goodies" from massive data-miners.

Just one little typing error at login and I have to go through this mess again...
I dont' want to know how many man hours are wasted on this shit every day. It's depressing.