There's a lot of arguments against captchas, but I do not agree with this one. You will always leak whether or not a password is correct based on how your app b

There's a lot of arguments against captchas, but I do not agree with this one. You will always leak whether or not a password is correct based on how your app behaves - a correct password will grant entry to the application. If you only ask for a captcha when a user account exists but fail to ask if they use a made up username, that's an information leak.