On: Why can’t a bot tick the 'I'm not a robot' box?

[cortesoft]

If you are using TOR, and not accepting cookies, they are going to have no way of knowing that you are the same user who just solved the CAPTCHA. Every request is going to appear to be from a new user.

If you do everything you can to prevent google from knowing who you are, don't be surprised when they behave like they don't know who you are.

[Dylan16807 → cortesoft]

Tor Browser accepts session cookies. It won't have an established google identity, but it fully supports a temporary "solved the captcha" identity.

[cortesoft → Dylan16807]

> The problem immediately goes away if you let google track you

I took that to mean they were blocking cookies

[puzzle → Dylan16807]

What prevents a botnet from sharing that same session cookie?

[Dylan16807 → puzzle]

A botnet doesn't need Tor in the first place. And you can limit the use of a single captcha solution. It's not much different from the problem of a legitimate google account being borrowed by a bot.