Lately I keep hitting that Hcaptcha page right after logging in with correct credentials.
You were actually being challenged before it even checked your credentials. It was seeing that you were hitting the login form and didn't have a record that you had passed a captcha recently, since you were using private tabs.
NO! STOP ACCUSING ME OF BEING A ROBOT, YOU !@#$ ROBOT!!!
At the time, it wasn't actually checking anything other than whether people were trying to log in. It's an effective way to slow down bots--and humans, but humans are usually only logging into a single account, whereas these bots were trying to log into tens of thousands. This gives us more time to assess the situation and determine the best response.
I hope this won't keep happening too frequently
Probably not. You may still see a captcha from time to time if we're getting attacked. For the most part, we try to avoid them.
Captchas aren't tied to connections, since
it's common for thousands of people to have the same IP address these days, through no fault of their own--it's just a thing ISPs do now. That means each time you close a private session we lose track of whether you've solved a captcha.
it's discouraging me from coming here as a member.
There's not a whole lot we can do about that, unfortunately. The alternative is that we let the credential stuffing attacks go through. We can stop most attacks without needing to resort to captchas, but distributed credential stuffing attacks are difficult, especially when each login attempt comes from a unique residential IP address.
Of course, if everyone had a good password, this wouldn't be an issue. Spread the word and we can ditch captchas:
if you know your password, it's a bad password.
