Show HN: BoundIt CAPTCHA: highlight objects in photos to prove you're human

I was a robot four times out of five. This sheds a new light on my existence.

On a serious tone, apart from a cool showcase of technology, do we REALLY need this? CAPTCHAs are the bane of everyone's internet time. Sometimes it works, sometimes it doesn't, sometimes I have to write strange unicode letters, when it fails I have to go back and re-input everything in the form,... And more importantly, the persons it's supposed to prevent from abusing a service are not likely to be stopped by these childish "anti-bot measures".

I have a background in breaking and designing CAPTCHAs at Microsoft Research; how is this un-OCRable?

If you're finding the objects automatically, you can write an algorithm to do that. If you're doing it manually, your corpus isn't going to be big enough, and I can just pay people to enumerate them.

Plus, for all of the examples I see on your page, you can just find objects of interest, which is fairly trivial, and that's probably going to be what you're looking for.

A few issues,

1. Not going to work for those with sight impairments. 2. Not going to work on mobile (in current form). 3. Its not any harder to break in an automated way then most other CAPTCHA's

I hate CAPTCHA's. With a passion. I even write automated CAPTCHA decoders for fun http://wausita.com/captcha/

If there is one thing the world does not need its another CAPTCHA. If you have something to protect all the CAPTCHA's in the world are not going to stop those who want to exploit it. They can be automated or outsourced (easily and for peanuts). CAPTCHA's should only be considered suitable for keeping random spam bots off your site, and even then adding a honeypot field is a safer bet.

If you are being targeted a CAPTCHA is next to useless.

More importantly than the technical issues, CAPTCHA completion is already big business. Where the common scripts are known to fail, malware developers just feed the CAPTCHAs over to call centres in Africa or somewhere else cheap.

Everyone wants CAPTCHAs that minimise the annoyance to end users, and that are hard for a machine to crack. But the above business model means that, as a service designer, you either need to accept some degree of CAPTCHA fail, or somehow not annoy your valid users whilst also make solving them take unprofitably long for a remote worker to do.

For everyone who seems to be getting false negatives, it's because you're tracing a space too large.

I was initially getting robot returns, but it seems to have a higher tolerance for not binding the entire target, rather than trying to get the entire thing and having non-target space in the enclosure.

With that out of the way...this isn't safe. Interesting idea, but not safe. All that's needed is an algorithm that finds the object existing in both images. This is trivial with your current setup because size doesn't matter, recognizing two clocks is pretty easy even if one takes up a full picture and the other takes up a corner.

Some possibilities, and problems with each:

1. If you try a more rigorous system, where there's two pictures full of images in both, then you might have a better chance. But you'll still be giving text instructions to specify which image is the one you need to trace, and this can be automated as stated above. As soon as you state the word of the image, it's going to be algorithm-able, unless you make the image so blurry or incomprehensible as to fool both machines and humans, which defeats the purpose.

2. You could specify nothing, and instead tell the human to trace two matching objects. Regardless of whether or not there's more than one matching set, you can still automate this and pass with a machine.

I think this is an interesting, and perhaps capable idea, but it's far away from having any practical or secure utility.

Isn't object recognition in a not-distorted environment relatively easy? Click-and-drag is something UI automation does all the time, so that's not the hard part, either.

A couple more thoughts: This requires a huge, human-written database (or it requires an algorithm ... and, oh wait, we already decided that if an algorithm can do it, then it's not really worth of being a captcha)

Also, a few of the images, especially the coffee mug ones, look like they could be solved by selecting the whole image.

I think the site/service is pretty slick and well-made. It worked well for me -- I'd be curious to see what kinds of boxes these people failing were drawing (or whether it's just a browser issue for them or something).

These comments are all pretty negative, and I think the criticisms are mostly valid, but I don't think you've made a bad product (though it may need some tweaking, and captchas may be on their way out now for the reasons others have posted).

I just know that I've felt awful before when receiving similar comments to these others, and I would have liked someone to remind me: you made something pretty good, and it wasn't a stupid idea.

You might consider using photos that have more than the target object in them. It is easy as heck for a computer to determine the bounds of an object in a photo, and increasingly easy for it to know what that object is. It's certainly no challenge to a bot to determine the bounds of the "coffeemug" when it is the only object in the photo.

Also, CAPTCHA of any sort just sucks. As a user, I only will bother with a site that uses CAPTCHA if it is providing something I absolutely must have. If it's something I may or may not use, and I'm presented with a CAPTCHA (of any kind), I leave.

I think the cats vs dogs ones were a bit more entertaining.

Why is it that computers can drive cars on a highway, but they can't discern a human from a Nigerian spam bot?

The whole necessity should be embarrassing to programmers w/ access to a powerful server.

If they put CAPTCHA's on the Xcode Build command, the whole problem would be solved within the week.

Eat your own dogfood, developers.

Four out of five attempts... I'm a robot.

I tried a couple more, with slightly better success, however one of those times I saw the same image in both panels.

And then, it broke rather oddly: http://i.imgur.com/LwYtKe2.png (time approximately 00:45 BST, firefox 21.0, Win7)

I like the idea but the whole thing about reCaptcha is that we are helping as well, and that is really compiling.. BUT maybe if u can add advertising pictures in the captcha that payoff the blogger/developer you can get more acceptance ..

CAPTCHAs were broken a long time ago when spammers hired real people to enter their values instead of relying on bots. In short, testing to see if the visitor is a human is protecting against spamming tactics from 2008.

I've failed 1/5. I thought I had it right though.. I must be dumb

Not sure if this is quite ready for primetime. I failed 4 out of 5 tries to prove I was human. The only one I passed was the wall clock pictures.

Edit: I'm using Chrome 27.0.1453.110 under Ubuntu.

It's a neat idea, and a good implementation at this point, but I don't like the idea of moving towards human-verification methods that won't work for the sight-impaired.

Nit-picking your copy:

Going from 10-14 seconds to 5-7 seconds per Turing Test isn't a 100% improvement, it's a 50% improvement. A 100% improvement would mean each run took 0 seconds.

I drew the box in the middle of the picture, despite what actual photo is (75% width / height of the original photo), 2 out of 15 times of trial, I get passed.

Doesn't seem to be working for me, I can't draw any boxes.

(I'm using Chrome 29 on a Chromebook.)

Every time I tried it said I was a robot. My ex boyfriend was right!

glad to see I'm not the only person failing here.

Seems like a good idea, but I'm pretty sure no one will ever user a captcha that repeatedly fails human input (even worse than reCAPTCHA).

Google's object recognition could already beat this, no?

this is cool - thanks for sharing. However - re-captcha is beautiful b/c it helps digitize goog books.

failed quite often. really struggled with coffeemug.