Comment by stickfigure
6 hours ago
I've been on the other side of this kind of thing (hero rather than villain, though I'm sure someone out there disagrees).
You can fairly arbitrarily increase the difficulty of user registration, far beyond what users will tolerate for viewing an individual page. You can exploit this; a bot needs to make many accounts for the activity desired, and it's not hard to make "generate account" more expensive than it's worth for the amount of activity they get from each account.
If it costs your attacker a penny to solve the captcha to make an account, and they can only get 100 pages out of an account, you win.
I think this asymmetry is a fantasy.
For many sites, your hypothetical penny to create an account is a cost an attacker would gladly pay.
What if you make MFA mandatory. Normal users should have little issues with that despite the increased friction but bots would struggle with this.