[brod]

And even more simply, verifying the user is a "real person" in contrast to verifying the user is the "right person".

[nialv7]

How does that help? Surely the attacker is a real person too.