In addition to the standard best practices on password logins. Has anyone considered a captcha like system but instead of just typing out what is in the captcha, the captcha will be directions on what you must do to your password during the login.
For example if my password was "password123" on the login page if I used that password it would not work. If you follow the message it might say something like add the letter "E" after the second letter in your password then add a "!" symbol at the very end. So a successful loging would require "paEssword123!". The requirements and complexity of the password alterations could vary greatly from one change to multiple changes to the types of changes. Every attempt would generate a new random set of password alteration requirements. So if they typed it in wong the next login might say capitalize the first 3 letters and lowercase the rest of the password, then add the number 5 in the second to last character spot (PASsword1253).
EDIT: You could not do capital/lowercase changes because since the original password is unknown the system could not strip out the alterations it asked for before testing the real password. But you could still do additions of characters.
Therefore (other then when they first created the password) their password is never entered into the website again as the exact password. So keyloggers wouldn't be able to just copy what they type in because the password would technically be different on every login attempt.
Granted if there was keylogging they might have 90% of the real password (depending on how much a user had to modify it during logins) but it still would make it much harder to guess and then write software that could read the rules of the captcha and alter the password (and they wouldn't even know what the real password is at this point) each time in a brute force attack.
Browser password saving or anything that saves passwords for you would not work, it would be little bit of a pain each time you had to login but if this was important data like bank information I would be willing to spend a few more seconds logging in for extra security, esp. against things like keyloggers.
Other then users having problems following the rules during the login, are there any other flaws to this idea? Does it sound like it would work or not work and why?
Thanks for your opinion.