I was reading this post from half a decade ago about the pros and cons of using captcha during a DDoS attack (How does CAPTCHA mitigate DDoS attacks?)
At that time there seems to be basically 2 opinions:
1) Captcha is good when DDoS is happening because it only requires a check for the captcha itself, no password hash and database hit if captcha fails.
2) Captcha is bad during DDoS because it requires processing to check the captcha making the request take up even more processing.
Today reCaptcha is everywhere. Most of us do not generate and check captchas on the server side, but just make a POST call to google to verify if the posted captcha is valid, how does this compare to hashing the pass and hitting the database in terms of processing time?
The POST request seems to takes longer, but the auth verification takes more processing time. How does this impact the server during a period of a DDoS attack?