> Wait. That's actually the opposite of great. That's why nobody uses it any more.
Unless of course, if you're using HTTPS, in which case HTTP basic auth is fine and very simple to configure for many use cases.
My guess on the reason why is two-fold. First, we've been telling people that Basic Auth is a terrible thing only stupid people would use for more than two decades now, and once a lesson like that gets hammered deep enough into the mass consciousness it tends to stay there even long after the underlying facts have changed. And second, using Basic Auth means giving up any possibility of styling/designing your login experience and relying instead on the browser's built-in dialogs, which tend to be clunky and ugly in the extreme.
For further risks, see e.g. https://security.stackexchange.com/questions/988/is-basic-au...
Yes, it's simple. And you're trading off security for simplicity. Make that choice, maybe, for your Intranet or your small blog. Commercial sites that have stored PII really, REALLY shouldn't.
Then it's more or less as broken as alternative authentication methods
Yes! It was great! People would just transmit username and password in plaintext!
Wait. That's actually the opposite of great. That's why nobody uses it any more.
And no, handycapped people aren't excluded just because something doesn't degrade gracefully into a no-JS environment. You can (and many people do) make perfectly accessible web sites that still require JS.
As for offloading captchas to the client? That suffers a similar problem to basic auth - it's extremely vulnerable because attackers can obtain access to information that makes their job trivial. That's why we cannot "come up with a standard" - the client has to be treated as hostile, because there's no way to verify their integrity.