You can do pretty aggressive spam detection in way less than 100ms.
Source: I wrote a system that can do it in less than 10ms at Grooveshark.
Source: I wrote a system that can do it in less than 10ms at Grooveshark.
You can learn a little about how we think about securing login here: http://vimeo.com/80460475.
Although it operates at a much smaller scale than most of the things linked to here it does work pretty well.