[gruez]

>This is giving me bad ideas about making the UI (and only way to log in) be to send the password 1 character at a time as it's typed, and then using some form of ml to try and identify probable bots.

at that point you might as well outsource that sort of fingerprinting/behavior analysis to some service like recaptcha.

[gpm]

I mean, I suppose my idea is basically "build a recaptcha competitor". Otoh in house recaptcha is "better" because

- Hackers haven't spent time breaking it

- It doesn't raise the same level of privacy concerns

- You control the UI (though recaptcha3 gives you that) and have greater insight into what the score means and why