Please reread what I said, as quoted above; I have edited the quote to put the key words in red.  If already building a spambot which opens web login sessions, it would be trivial to make it keep many different sessions in parallel.  Get them all logged in—perhaps via a scammy website which proxies the CAPTCHA, and offers real or imaginary freebies (free Bitcoin!) for completing CAPTCHAs.  Then, leave them logged in.

You incorrectly assume that a spammer must log in his sibyl accounts from the same IP address.  Spammers often have many IP addresses; and indeed, it would be easy to do away with account farmers if they always logged their zillions of accounts in and out from the same IP address.  Also, multiple accounts can be logged in from the same IP address.  Either way, there is no reason for a spambot to ever log out.

Since multiple users can be legitimately logged in from the same IP address, banning IP addresses for failed login attempts is also not a solution to bruteforcing.  If theymos did that, then it would be trivial for an attacker to effectually ban Tor users from login to bitcointalk.org by deliberately making many bad login attempts from every exit node.  Thus, I infer that theymos does not do this; and I assume the timeout you describe somehow works with cookies, or the like.  Granted, I could be wrong there.  It may simply be that nobody evil has thus far bothered to get Tor exits banned from attempted login.

Assuming a correlation between users and IP addresses is a common fallacy.  N.b., I have no idea how many users are currently logged into bitcointalk.org from the same IP address as I am using to post this right now.  I’m almost certainly not the only one; moreover, my connecting IP address frequently changes.  There are also reasons other than privacy why many users may share the same IP address:  Carrier-grade NAT due to IPv4 address exhaustion, corporate proxies, etc., etc.  —Also reasons why the same user may rapidly change IP addresses:  Mobile users....  There is not and never was any strong correlation between people and IP addresses; security systems which assume that tend to simultaneously lock out legitimate users, and fail to lock out malicious attackers.  Failure both ways.

---

Well, if you signed up via Tor, then you must have some Bitcoin; theymos charges a small anti-abuse fee for new account signup from Tor and other IP addresses which have high risk for abuse.  And if you didn’t sign up through Tor, then you are mixing Tor and non-Tor usage for the same account.  That’s a big privacy no-no.

If you use Tor, then you should use only Tor Browser for your web browser.  I actually dislike it, myself; but it has special privacy and antifingerprinting features, and also, it helps you blend into a crowd when you use the same browser as everybody else.  The technical term is “anonymity set”.  If you use a different browser with Tor, then you may still be more or less readily identifiable and/or trackable (web session linkage).  You could be the only person using Browser X in a crowd of two million people using Tor Browser through Tor exits.  If you want to use some privacy network other than Tor, I have no specific advice for you at this time.  But this is all off-topic.  If you desire a few further tips of where to learn about these things, feel free to ask your question in the Off-topic forum and PM me a link to your post.  Just don’t get sucked into the huge heaps of trash posted there—much of which is posted by spammers trying to up their post counts; that’s the kind of dirt which can rub off on a newbie, if you get involved with it.

Forums can use the two and the members could select which option they like to log with it.
I remember such feature was used in faucets years ago.

I don't quite understand what part of my post you refer to as speculating. But I'm utterly curious what makes you think that all spammers (well, most of them) have simultaneous access to multiple IP addresses (if that was your point). Anyway, why don't you just ask theymos directly (via PM or elsewise)? I guess he is the only one who can give you precise answers as to his intents and purposes. But since you are still sticking around here, I arrive at a conclusion that he is not likely to respond to your queries. So who is wasting whose time actually?

But never mind. When you are a newbie you can't post more than once in a while (like 6 minutes or so), and if you try you will get a warning that clearly states that your IP address is being limited, i.e. not your session or whatever. What else do you want to know?

Nobody has mentioned in this thread that google captcha blocks the forum entirely for a billion people living in China. 

Likely this is important information to consider when choosing whether to force users to use a google service while accessing the site. 

What would be the solution to this though? Assuming there would have to be a compromise we would likely see this abused by the many and more bots would be registering and spamming the forum. Chinese members could just use a VPN to sign up, unless there's another alternative which is just as effective as keeping the bots away.

There's services which offer to write out the captcha and send it to the users registering, so any other system which doesn't use the image could easily be abused and automated.

What you are saying is, why have any local forums at all?

Actually, why have a forum at all?  Creating a similar forum for me would really not be a problem, yes?  And another one for you?

---

Prescribing any kind of censorship circumvention measure is problematic as for users in a country which blocks censorship circumvention measures.  Though there are always ongoing concerted efforts to keep Tor available to PRC (People’s Republic of China) users behind the GFW (“Great Firewall”—adverse nickname for PRC network censorship measures).  It’s an arm’s race.  And then, Chinese-through-Tor users would hit the reCAPTCHA problem I had:  “Google is locking Tor users out of Bitcointalk.org!”  I would suppose that some/many VPNs (as you suggest) might hit similar trouble, though I have not tried VPNs with this forum.

Here is an interesting bibliography, which includes references to many research papers written on GFW:
https://censorbib.nymity.ch/


Well, there’s your usual CAPTCHA arms race.

I myself would much prefer public-key authentication for login.  It’s a “crypto” forum, yet does not deploy basic cryptographic techniques for authentication!  Of course, this would make it trivial for bots to log in; and this returns to my unanswered question which I have asked many times upthread and elsewhere:  Is the purpose of the login CAPTCHA to stop login by bots, or to stop such bruteforcing of luser-selected passwords as may result in (more) so-called “hacked” accounts?

By the way, there is a(t least one) existing patent on a method for issuing fake or impossible CAPTCHAs to deny access to a service while pretending to allow access:
https://via.hypothes.is/https://www.google.com/patents/US9407661
(In other words:  A patent on a method of being a jerk and intentionally wasting people’s time, effort, and frustration.)


N.b. that the reference to typing on “a standard keyboard” unavoidably implies that the term “attacker device” includes humans (a/k/a not-a-robots).  The only conceivable purpose for serving an impossible CAPTCHA to not-a-robots (formerly known as humans) is to torment and lock out flesh-and-blood users on networks such as Tor.

Think of this, next time you see some error-comedy site post a screenshot of a “broken” CAPTCHA containing weird characters.  It’s not broken:  It’s sadistic and deceptive.

---

As linked above, some of us have trouble even getting a CAPTCHA—broken or otherwise.  Then when I can get a CAPTCHA, it steals time out of my life—60–90+s each time, mindlessly clicking pictures in servitude to a machine.

I myself have not yet received an unsolvable CAPTCHA on this forum.  Only either refusal to serve a CAPTCHA, or extremely drawn-out and tedious CAPTCHAs.


So would I—with the caveat that I would not pay more than I already have for Copper Membership.  If the purpose is a steeper anti-abuse fee which provides greater deterrent to abuse, then that shouldn’t be turned into a money-grab.  Doing so would be wrong, a squeezing of innocent people under false colour of stopping the wrong of spammers who treating this forum as a money-grab.

However, you raise a chicken-and-egg problem:  How does the forum know to whitelist a paid user at the login page?

That's true, it can be quite annoying when were selecting photos using our phone. It tends to misalign when you try to zoom into it then when you zoom out as well. Sometimes when you try to scan through the selections, it  tends to select when you just want to browse. I just feel that its response when using a phone is slow. It's not a big deal though, but it can be time consuming at times.

half a month necro/
I am using firefox latest version, i didn't have a problem until yesterday, i have to solve 20 recaptcha and mind you i have to select sometimes street signs in a photo without any street signs! this is ridiculous and annoying.

I really dont mind having them here in the forum as long as they are fast to load. Although I'm patient from waiting but not that long enough like the captchas in 2captcha.com, that's why I quit that work. Its just a matter of time just to solve it so if you added it here like the one from the log in I guess there won't be a problem.

It doesn't matter if I think because it is usual to avoid security robots that enter and roam mainly in this forum who could make the post contains useless garbage.