A captcha that will not pass
You have typed it correctly four times. The site disagrees four times. Almost always this is not about the characters, and the standard reaction of trying harder and faster is the one thing that makes it worse.
- What it is
- A challenge that keeps rejecting a correct answer
- Where you meet it
- Before login, sometimes between pages
- What it settles
- Nothing. It is a load control, not a check on you
- Cannot tell you
- Whether the problem is you, the route, or the far end
The specimen
attempt 2 answer accepted? no you slow down and read carefully
attempt 3 answer accepted? no you start to suspect the site
attempt 4 answer accepted? no rate limiting has now started, if it had not already
the fourth failure is usually caused by the first three
The loop, written out. The trap is that every refusal looks identical, so there is no way from the screen alone to tell a wrong answer from a dropped circuit from a limit you triggered yourself.
Work through it in this order
- Check the address first. A form that refuses correct input is also what a copy looks like once it has taken what it wanted. Do this before the fifth attempt, not after.
- Build a new circuit. A dying route produces failures that read exactly like rejection. This fixes it more often than anything else on the list.
- Check your clock. If a time based code is involved, a machine with drifted time fails every attempt while the user does nothing wrong.
- Try a different address from the set. Failing on one and working on another points at that address rather than at you.
- Then stop and wait an hour. Repeated attempts trigger limits, and a limit is indistinguishable from a refusal from where you are sitting.
Why it cannot tell you more
A hidden service cannot see who is connecting, so everything protective it does has to be behavioural. Slow down repeats, refuse bursts, drop connections when loaded. All of those arrive at your browser as the same blank refusal, and giving you a more helpful message would also be giving it to whatever is hammering the door. The vagueness is deliberate and it is not aimed at you.
Why the same refusal covers several causes
A hidden service cannot see who is knocking, so it cannot give one answer to a person and another to a flood. Everything it does to protect itself has to be behavioural, and behavioural measures arrive at your browser as the same blank no. Telling you which cause applied would also tell whatever is hammering the door, so the vagueness is deliberate and it is not personal.
That is also why the fix is a sequence rather than a diagnosis. You cannot work out the cause from the screen, so you cycle through the cheap remedies in order and one of them works.