This is incredibly dumb. While we've traditionally talked about bots vs humans, this was always just a standin for what we actually cared about: legitimate vs i

This is incredibly dumb. While we've traditionally talked about bots vs humans, this was always just a standin for what we actually cared about: legitimate vs illegitimate operations. If you're a business owner selling office supplies, do you really care if an order was placed by a biological human or by an automatic reorder script? No. So long as somebody is going to pay for the order, it doesn't matter. Conversely, if someone is trying to brute force a PIN, does it matter if it's a human typing in combinations or a script entering them at the same rate? Nope. The concern about bots is that they can do things repeatedly and quickly. Placing one order is great, placing 10,000 orders is problematic. Brute forcing a 4 digit PIN is tedious for a human, trivial for a machine. But just because a script can potentially be used to abuse a service does not mean there are no legitimate use cases, and just because it's harder for a human to do these things doesn't mean they won't. When people want to stop bots, what they really want is to limit the rates and attempts of certain actions. CAPTCHAs somewhat achieve this goal - if the adversary doesn't employ an effective CAPTCHA solver then its effectively an attempt limiter, whereas with such a solver it's a rate limiter. However, since the goal of a CAPTCHA is not to effectively limit rates or attempts, it is not a very good limiter - the captcha might kick in on the first attempt, blocking perfectly legitimate scripts, and with a solver the rate limitation may be trivially small, and remain constant. A properly designed system would only kick in after some suspicious activity had been detected, and would progressively become more burdensome as the user strayed further from expected behavior. This new system may exceed CAPTCHAs at identifying humans, but that is not what we want. An automatic button presser is much easier to implement than a CAPTCHA solver, and whereas the CAPTCHA solver might be broken by a mild change to the CAPTCHA on the backend, the button presser will work so long as the button its pressing does. Thus it is much worse as an attempt limiter. As a rate limiter, they claim it has a longer interval than current solvers, but again more advanced CAPTCHAs are easily possible, and it still suffers from the same limitation as CAPTCHA in that it must remain unobtrusive for legitimate users, so it can not make its rate limitation too large. In short, this is just a more easily defeated and more difficult to improve version of CAPTCHA. There may be some niche applications where guaranteeing a human user is actually the desired outcome rather than a proxy, and in those cases this key might be a good alternative to CAPTCHAs for the further small minority who have disabilities that make CAPTCHAs difficult to use, yet for whatever reason have no problem accessing and using a physical device. Still you're talking about an edge case of an edge case of an edge case.