> The onus for proving that a visitor is not a bot should be on the server side,

Unfortunately that's exactly what is happening with ReCaptcha checking for Google cookies.

I'm not sure I follow. Cookies are stored in the client.

Yes, but they are only set by Google's server if the user has some sort of reputation (logged in on a Google account, visited Google before with cookies enabled, etc).

I'd imagine they may already be. I've been having a -lot- of issues with captchas lately. It's not my eyes getting worse, they seem to be getting both more esoteric, and the letters all crammed together. Is that cl, cI, ol, oI, or d? It often takes me multiple attempts.

google is already trying to retire them. v3 has no challenges, they just generate a score completely transparent to the end user

"Transparent" until Google doesn't trust you for some insane reason.

Now I can be denied access because of an opaque score, with no way to get around it.

Yay, progress!

yup. Setting some tor privacy extensions in Firefox already locks you out of Google login. Yay!

hah yea, their sales pitch here left a bit to be desired. Once a user gets a low score a recaptcha implementer should make a cell phone number collection system to have their own trust system based on that...

and yet can still be bypassed by captcha solving services

There are already extensions for that.

Server should never trust client input

How would it make that determination?

That's not my problem. As a user I should not be inconvenienced for a problem caused by someone else. The offending party should pay the price.

That's not the server's problem. As the server, they should not be inconvenienced for a problem caused by someone else. The users (which includes the bots) should pay the price.

Do you want my business? I have gone elsewhere with my money instead of solving for crosswalks before

And that works very well for every website you pay to use.

What percentage of websites that you use is that, exactly?

I booked a hotel room elsewhere just this weekend.

You know? That's fair. I hadn't considered the kickback model that booking sites seem to use.

That's fair. I think your solution would work for those.

Finally, someone willing to advocate for the voice of the server rather than the obstinate user!

No, the users do not include the bots. You have this backwards.

Bot are most certainly users. How is the server going to tell the difference?

https://continuations.com/post/180985743645/world-after-capi...