Is it possible not to use captcha during authorization and registration?

Question

PHP

Hello. I use AJAX authentication on my site. I send data via POST.
But I don't want to use captcha during login. But I did it differently. I set up a simple counter of invalid attempts. If there are 5 of them, then the session does not allow more authorization until the user starts a new one. Does this method have disadvantages and will it withstand brute hacking (chtoli) well, I'm talking about the idea in general. I say right away that the captcha field of 3 incorrect attempts used to be turned on. But removed. Decided it wasn't needed at all. You can make up to 10 incorrect attempts. Not the point.

Answer 1

I am also against the default captcha.
When authorizing, I hang up the counter of unsuccessful attempts on the username (not on the ip + useragent pair). After 5 unsuccessful attempts within 5 minutes I display the captcha.
When registering, the counter can be hung up on ip.

Answer 2

Any data tied to the client side (sessions, cookies, etc.) will not protect in any way from password brute force.
The easiest option is to write down the ip and the number of unsuccessful attempts, then, if exceeded, either pause between attempts (try after 5 minutes) or show the captcha (that is, not immediately, but after 5 unsuccessful attempts).

Answer 3

Well, with authorization, it’s still okay, but you also mean registration.
there will be a lot of bots without captcha

Answer 4

Deleted session cookie = attempt counter reset?
It doesn't protect at all.

Answer 5

What's the problem with using it?
Put Google captcha where it is enough to click in the box, and that will be enough:
https://www.google.com/recaptcha/intro/index.html
But without captcha, this is a bad idea in advance)

Answer 6

IP restriction is not always an option. For example, at my house (apartment building) the whole house is on one (!) ip.