Heh. I took the advice, went in and checked source expecting to see the captcha string in a hidden form element.

I use NoScript and Sony.com is not on my whitelist (read: I could just select/copy the string).

This was worse than I imagined.