>One particularly egregious misuse of captcha in a service I use presents one after I enter a correct username and password. I run a problem validation communi

>One particularly egregious misuse of captcha in a service I use presents one after I enter a correct username and password. I run a problem validation community platform. Couple of days back an individual launched automated spam/DDOS attack by commenting an abusive, demoralising text on every single thread by creating different users. Fortunately, I had systems in place to identify and mitigate it with Cloudflare. So, in this case even genuine users would have received captcha. I found out soon enough who the attacker was from the firewall, he had earlier created an account with his own name and was using the same IP to attack, after I blocked his IP he tried with couple of other IP addresses incl. Tor; but stopped with his activity after couple of hours. I generally don't like re-captcha because it takes cultural background for granted(e.g. 'Pie' is not a common food worldwide), Accessibility as a disabled person myself and has no mitigation for captcha-solving farms. But in nuisance cases like the one I detailed above, captcha is the easiest method available en masse.