If you are concerned about brute force attacks, have your 
authentication backend have long delays on bad authentication 
requests.  Or require passwords above a certain length.  Combining 
captcha's with password is unneeded replication.

I agree with Jan, and further, adding a captcha to the equation just 
adds a _different_ resource to try to DoS.

This is something that should be implemented in the authentication 
backend, not in the frontend.

Example: testing login on Horde by sending different login/password. 
Of course, the server will reject all bad accounts but this will cause 
using some resource and can cause an attack like DoS attack (server 
using too much time processor and other resources to treat requests).

Your initial request was misleading in this regard, but I still don't 
see how this would help you to protect against robots. And against 
robots doing what exactly?

When I say "after the login and password", I don't say that a CAPTCHA 
must be run after a successfull login. I just say that the field must 
be placed after the login and password field, but on the same page !

The question isn't trusting or not the backend.



Many robots can search to log on Horde. A CAPTCHA solution blocks 
robot's query.

No, and it doesn't make much sense. If you don't even trust your 
authentication backend, why would you trust a CAPTCHA?

Hello,



Is there any way to add a CAPTCHA control on the login screen (after 
login and password) ?



Thanks