A classic case where captcha is essential is ddos attacks. By sheer volume, they are not able to bypass captcha, as they can't solve captcha at million qps. Rat

A classic case where captcha is essential is ddos attacks. By sheer volume, they are not able to bypass captcha, as they can't solve captcha at million qps. Rate limiting doesn't work under ddos as ddos attack can overwhelm rate limiting itself and also there are still many proxies that simple ip base rate limiting will cause large collateral damage. Captcha is a very effective tool for ddos protection. For spam/abuse, captcha is mainly about raising the cost of attack, not about eliminating completely, while still minimizing the collateral damage. Captcha is never meant to be a protection against any targeted narrow scoped attacks anyway. If the attack is small enough that attackers can pay captcha solving service, it's not big enough to matter. Captcha is here to stay. It is fundamentally a technical mean to deal with the tragedy of commons, and thus won't disappear anytime soon.