I am working on a site and I would like to add CAPTCHA to the user registration page to prevent user name enumeration.
I am working with a front end developer who feels pretty strongly that we should not add CAPTCHA to the registration page because it's a pain for users and will reduce our conversion rate.
I know that there is sometimes an inverse relationship between the security of a site and the usability of the site and that some security vulnerabilities are worse than others.
If there was something like a SQL Injection vulnerability I would insist that we fix it, but I'm not sure if a user enumeration vulnerability is serious enough to justify me fighting for this particular fix.
How important is it to have CAPTCHA on a registration page and how seriously should user enumeration attacks be taken?