I like the idea but the whole thing about reCaptcha is that we are helping as well, and that is really compiling.. BUT maybe if u can add advertising pictures in the captcha that payoff the blogger/developer you can get more acceptance ..
Show HN: BoundIt CAPTCHA: highlight objects in photos to prove you're human
31–38 of 38 posts
Re: Show HN: BoundIt CAPTCHA: highlight objects in photos to prove you're human
#32[deleted]
Re: Show HN: BoundIt CAPTCHA: highlight objects in photos to prove you're human
#33Isn't object recognition in a not-distorted environment relatively easy? Click-and-drag is something UI automation does all the time, so that's not the hard part, either. A couple more thoughts: This requires a huge, human-written database (or it requires an algorithm ... and, oh wait, we already decided that if an algorithm can do it, then it's not really worth of being a captcha) Also, a few of the images, especial…
That's a good point, but we are a long way away from an automated general object recognition system. This discounts occasional outliers such as obvious objects which take up the whole page, or ones that are clearly visible against a gradient-less background (both of which can be pruned). Currently, we are validating inputs from a human written database, which is continuously being expanded with new user inputs and ne…
An attacker might not even need to use object recognition.
The 'noun' (beerbottle, golfcart) is always in the same place in the DOM (so, easily targetable as text) The urls for each image appear to be constant as well. I also discovered the element with the token and the structure of the POST requests to get the pair of images as well as to send data. It might be possible to just bruteforce it with a little scripting, to send random boxes based on the size of the images and when I get "success" back, I know to associate those boxes with those image urls.
I assume I can't simply replace the images with ones I want (that would be insane) but I might be able to just bruteforce it with calls to the api until I get images I know. I would suggest that rather than exposing the actual image urls, you serve them up with obfuscated urls (though I personally wouldn't even want them to be publically accessible anyway.)
Also, maybe add a bit of good old fashioned cruft to the images themselves, to throw off attempts at storing their hashes. Maybe rotate or flip them now and then, change the colors, add random lines, filters, etc (basically what happens with text captchas.)
Just some random ideas.
Re: Show HN: BoundIt CAPTCHA: highlight objects in photos to prove you're human
#34For everyone who seems to be getting false negatives, it's because you're tracing a space too large.
I was initially getting robot returns, but it seems to have a higher tolerance for not binding the entire target, rather than trying to get the entire thing and having non-target space in the enclosure.
With that out of the way...this isn't safe. Interesting idea, but not safe. All that's needed is an algorithm that finds the object existing in both images. This is trivial with your current setup because size doesn't matter, recognizing two clocks is pretty easy even if one takes up a full picture and the other takes up a corner.
Some possibilities, and problems with each:
1. If you try a more rigorous system, where there's two pictures full of images in both, then you might have a better chance. But you'll still be giving text instructions to specify which image is the one you need to trace, and this can be automated as stated above. As soon as you state the word of the image, it's going to be algorithm-able, unless you make the image so blurry or incomprehensible as to fool both machines and humans, which defeats the purpose.
2. You could specify nothing, and instead tell the human to trace two matching objects. Regardless of whether or not there's more than one matching set, you can still automate this and pass with a machine.
I think this is an interesting, and perhaps capable idea, but it's far away from having any practical or secure utility.
Re: Show HN: BoundIt CAPTCHA: highlight objects in photos to prove you're human
#35Nit-picking your copy:
Going from 10-14 seconds to 5-7 seconds per Turing Test isn't a 100% improvement, it's a 50% improvement. A 100% improvement would mean each run took 0 seconds.
Re: Show HN: BoundIt CAPTCHA: highlight objects in photos to prove you're human
#36A few issues, 1. Not going to work for those with sight impairments. 2. Not going to work on mobile (in current form). 3. Its not any harder to break in an automated way then most other CAPTCHA's I hate CAPTCHA's. With a passion. I even write automated CAPTCHA decoders for fun http://wausita.com/captcha/ If there is one thing the world does not need its another CAPTCHA. If you have something to protect all the CAPTCH…
It appears to work just fine in Mobile Safari for me. I just dragged to draw the box and it worked quite well.
Re: Show HN: BoundIt CAPTCHA: highlight objects in photos to prove you're human
#37It's a neat idea, and a good implementation at this point, but I don't like the idea of moving towards human-verification methods that won't work for the sight-impaired.
Re: Show HN: BoundIt CAPTCHA: highlight objects in photos to prove you're human
#38I have a background in breaking and designing CAPTCHAs at Microsoft Research; how is this un-OCRable? If you're finding the objects automatically, you can write an algorithm to do that. If you're doing it manually, your corpus isn't going to be big enough, and I can just pay people to enumerate them. Plus, for all of the examples I see on your page, you can just find objects of interest, which is fairly trivial, and…
Hey Tyler, You're right about certain images having easily distinguished objects-of-interest. In the future, running a routine to weed those easy ones out will stop any being solvable by bots. And also, as with any other captcha, paying other humans to validate themselves for you will always be an issue. We validate users' inputs against a pool of manually-entered data. Because we collect a pair of annotations for ea…
What he said was that if you manually preparing the images then the number of different images will be low enough that he can pay other people to solve the complete set - a one off cost.