What they do at present appears to be to assign long term reputation to tor nodes, but if instead they assigned reputation over a few minutes and reset it soon after, wouldn't that work better and avoid being overly broad? More load for them obviously but could possibly be done just for tor nodes.

The token scheme looks interesting though as long as it was truly anonymous and tokens were different on each request to avoid tracking.

https://github.com/gtank/captcha-draft/blob/master/captcha-p...

i wonder if they could do a plugin for the tor browser so that they don't have to wait for tor?