Update: I was subject to the captcha again, and this time I took screenshots.
Update 2: I have created a Facebook group for fighting this security feature. Once you have your account back, join the group and invite your friends!

Facebook has recently and silently introduced a new “security” feature, that does a lot to prevent legitimate users from accessing facebook, but almost nothing to deter determined scammers and hackers.

The security feature works as follows:

Suppose you try to log in to Facebook from a location you don’t usually use, for example when traveling (which is usually when it’s most important for you to keep in touch with friends and family). Facebook asks you to verify your identity.

And how would you do that? First, you have to solve a CAPTCHA. Fair enough, just prove you’re human.

Next, starts the tricky part. You need to identify your facebook “friends” by identifying photos where your Facebook friends have been tagged. In order to regain access to your account you need to solve a CAPTCHA, then identify 7 out of 9 photos of friends. Even a single error fails the test but you do have two “skip”s.

The photos are selected randomly from all photos in which any of your friends have been tagged. If you fail, you can try again within an hour. Returning to a “verified” location does not help once the roadblock has been triggered.

I guess the reasoning behind this: If you are really you, you should be able to identify your friends by their pictures. Right? Wrong! First of all, Facebook (and certain apps) keep pushing you to add more and more distant acquaintances as friends. People who you’re unlikely to even identify by seeing a clear picture of their face. Second of all, people tag each other in photos that are nothing like a clear portait. When I was faced with the challenge I had to tag pictures of feet, pictures of dogs, blurry pictures of people from behind, and “funny” drawings. I am not the only one. Many people have been locked out of their accounts for hours due to this impossible “security” challenge.

Below is an example of one of the worst images I’ve got in my challenge:

The pictures are low resolution, and the pic itself is an xmas card. One of the faces is almost completely obscured by a hand holding a camera. The person in the picture is a work acquaintance I have never met it person, and the worst thing security-wise (and lucky for me) is that the greeting text includes his name!

How did I eventually regain access to my account? The same way any attacker who isn’t me could have. The questions in the challenge are multiple-choice. One or two pictures and five names to choose from. Since my profile is relatively open to the public I could create a bogus Facebook account and see my friend list and their public pages. Most of these include a profile picture which allowed me to try and verify the person. Some have a more public profile where all pictures are available, and then I could find the actual picture from the challenge — just like anyone who isn’t me could have.

After finally succeeding in solving the challenge, I was presented with the oh-so-horrible offensive access. I tried to login to Facebook Chat from the United States. Thanks for being so specific, Facebook.

After guessing this is probably OK comes the next screen asking me to be a fan of Facebook Security. What can I tell you, I am not a fan!

From a security perspective, this is not at all useful. An attacker’s arsenal would include looking up public friend info, and creating a new account with my name and photo, and trying to “friend” all my Facebook friends. With enough people accepting this friendship (which many will), you can access all their photos and easily solve the challenge. In fact, this could be automated, and the only obstacle is several CAPTCHAs that need to be solved, a problem easily solved by spammers using outsourcing or fake “free porn” sites.

Finally, I would like to suggest several other security methods that could actually work:

• Require a user to tag only photos he or she has uploaded, or that he or she appears in. Ask about where or when a picture was taken, and be more lenient.
• Require a user to use an alternative method to contact a few of his or her friends (of the user’s choice) and have them log in can confirm they are OK (for example by giving them some kind of key).
• Get security questions or challenges from the users in advance — something the user knows he or she can solve. Make it clear that these questions are not ONLY for the case of lost passwords.
• Make a phone call or send a text message to a phone number that is in the user’s profile with a key to access the site.

Better still, allow several of these methods at once. Besides, Facebook is not a bank. Just let go of the stupid security.

Here is Facebook’s real world contact information. Call them, send them a letter, or drop by their offices:

1601 S. California Ave.
Palo Alto, CA 94304
USA
+1-650-543-4800 (Phone)

Last Saturday, I went to the Vertical Challenge Helicopter Show at the Hiller Aviation Museum San Carlos airport. The show included admission to the museum and an exhibition of military and civilian helicopters. The main event included helicopter aerobatic demonstrations, RC Helicopter presentations and a search & rescue demonstration by the US Coast Guard.

After the show, I came back home, realized it was really hot, in spite of the fact I’ve ordered a fan off Amazon the day before. It seems fans don’t really work before they are delivered, and this particular Amazon order would take two weeks to arrive. After checking the options of faster shipping, I suddenly recalled a different way to get products: Retail. A Home Depot was less than 5 minutes from my home, at I verified online that they indeed stock fans. A short trip back and forth and a fan was in my possession. A few minutes later, it was assembled the room was significantly cooler.

Later this week, on my way to Stanford, the police have suddenly stopped me. The officer explained that I was driving 40 in a 25 zone (this is MPH, so it’s actually 65 in a 40 zone in kilometers) and gave me a ticket. The officer was not able to say how much the fine was, so I will know that only when I get the ticket in the mail.

Upon reaching Stanford I had a positive surprise. My laptop, that I’ve ordered two months before, has finally arrived and works great. I took it home to complete the installation and it will soon replace my old one. Expect being able to video-chat with me any time day or night (assuming I’m online and you have skype).

This weekend features Paul’s boardgaming extravaganza and BAP’s games day. Next weekend is the 4th of July, aka Independence Day. Stay tuned.

P.S. Thank you all for purchasing stuff via the DealExtreme links in my last post. I got more than 20 points already. If you did buy anything, please comment and tell me what you got. Thanks!

The story starts nine months ago, on my first arrival to the United States. From the start I knew I have to get myself a cellphone and thus I have bought an iPAQ and a T-mobile prepaid SIM card. However, the SIM card was sold without the PIN code required to make changes to the account. This was not a problem for me, as I could still use the phone and add minutes.

Three months ago, I decided that I will spend more than a total of $100 in a year and thus I could load up to a $100 immediately and get extra benefits: 15% more minutes, and the minutes expire only after a year. Assured of my new “gold” status, I did not buy any more refill cards.

And then, suddenly, yesterday I discovered that my balance of more than $50 became 0. I called customer service and they explained that the 1-year expiration applies after the NEXT refill after I qualify for gold, but she agreed to credit my $50 back. All she needed was to confirm my identity with the PIN I did not have. She said I will have to identify myself at a T-Mobile location and get a new PIN before I could get my minutes back.

As I neeed to make a call right away, I added $10, immediately losing 35 cents for not buying the card as Safeway, and decided I’d go to a T-mobile location the next day. At the T-mobile location, I asked to confirm my account, but they said that my ID must match the name on the account. After several minutes of asking for help, I asked them to check whether or not my name is on the account. It turns out it was, and new PIN was assigned. Now all I had to do was call customer service and have them credit my minutes.

Well, in case any more problems will arise, I decided to call customer service from the T-mobile store. After a short wait, the rep told me that they cannot credit my account since more than 48 hours have passed since the balance expired. I asked to speak with a manager, they complied, leaving me on hold for at least 30 minutes. While on hold, I called them back from my cell phone and got the same reply from two additional reps, asked to talk to the manager, and got disconnected, and then tried again.

After more than 30 minutes of waiting, the final rep managed to get their supervisor to credit my account. An amazing waste of time and money for just $50 that were rightfully mine. Once I deplete my balance I will seriously consider switching to another provider.

T-mobile and the color Magenta are registered trademarks of Deutsche Telekom.

As many of you may know, I am in the US on a temporary exchange visitor visa (J-1), and my stay has been extended for an extra year. My visa, however, expires on Sep. 30th. This is usually not a big problem since I am formally allowed to stay in the US even after my visa is expired, as long as my fellowship is valid. However, without a valid visa I’m not allowed to return to the US.

Applying or extending a US visa has to be done outside the US, and requires leaving your passport at a US embassy for at least a few days while your visa is processed, so it is recommended to do so in your home country (in my case, Israel) to avoid being stuck at a foreign country with no passport at all.

No problem I thought, I will go to Israel for the High Holidays right at the end of September and extend my visa then. The problem began when I realized I have a conference in Beijing, China right at the same time (end of September till the beginning of October), which means I will not be able to return to the US after visiting China without a valid visa.

I checked the option of flying round-the-world SFO-NRT-PEK-AMS-TLV-AMS-SFO, however that was too expensive. The only option I had was to fly round-trip to China and then to Israel the long way through San Francisco. Due to my visa problems, I will make my stay in San Francisco only a few hours long and so I could use a transit visa instead of my expired J-1 visa, which will hopefully not terminate my J-1 status. My final itinerary will therefore be SFO-NRT-PEK-NRT-SFO-AMS-TLV-AMS-SFO, that’s 30,000 miles of flying, crossing two oceans twice, with the PEK-TLV part being almost 10,000 miles longer than the direct route, and 7,000 miles longer than the reasonable Amsterdam connection.

As far as booking is concerned, I have already changed my return flight to Israel and I will be arriving on Yom Kippur, October 10, 2008 at 1:10 AM. Hopefully, the flight won’t be full of religious folk…

Today I got a license. Not for software, but a driver’s license. As of today, I am a fully licensed driver in the state of California. As I have mentioned earlier, I had to pass both a written and a driven exam. Today I passed the driven exam and immediately got a temporary license.

My plastic license will be mailed in 10 days, and then I will be just like any American with a Social Security Number, credit and debit card, and a driver’s license. I can’t vote and don’t have a US passport, but then again, most Americans don’t vote or have a passport either.

After returning from Mexico, I had a lot of things to take care of. I got lots of mail in my office: A new miniSD card and a new SIM for my iPAQ, an American Express credit card, a and VISA debit card. I also had to print a paper I have to review and read a backlog of Hebrew e-mails I couldn’t read on my iPAQ (I still have a backlog of blog posts to read).

After taking care of all that in Stanford and eating lunch, I headed for the Social Security office in Redwood City. After I few wrong turns I have finally arrived and had to wait in line for about an hour, so I read the paper I have brought with me. When my turn finally arrived, I submitted the form and was told I’d get a social security card that’s valid for employment in six weeks, however the number will remain the same.

Two blocks from there is a California DMV office, where I applied for a driver’s license and passed the written exam (with only one mistake). I was issued a temporary license on the spot and scheduled a driven test for two weeks later.

After finishing these errands, I returned to Stanford and joined another event of the Stanford Jewish community, held in the Sukkah. There I met another new post-doc (only a week here) that knew me from FishEye. I told him some useful information about getting a car and a driver’s license and we exchanged e-mails.

The event ended at 9pm, and it was just time to go see House on FOX. It seems that the TV method of seeing shows has the major disadvantage of having commercial breaks interleaved with the show, however you can see shows only 3 hours late (we’re on the west coast) and before they arrive on file sharing.

Today I came to the office early as I forgot the charger of my iPAQ and my battery has run out. I’m still waiting for the extended battery I ordered to arrive. No special plans for today, though I do plan to begin doing actual research.

P.S. check out the posts from Mexico, as I have added links and pictures.

I haven’t updated in some time. You don’t have to worry. I’m doing fine. Yesterday I picked up my brand new blue 2008 Toyota Yaris, all paid for and insured. So now I have a car and a place to live. I got a good deal on the car and paid only $16,300 for it including all taxes.

Today I bought a parking permit for the car, so now I can actually park on campus. I also finally got my student number and ID card, and my network ID, so now I can use my laptop anywhere on campus.

I have done other stuff this weekend. On Sunday I went on a short hike to “the dish”, a radio-telescope here at Stanford and made some new friends from all over the world.

I was also told about a BBQ at the Jewish center here at Stanford on Monday night so I went there as well. Many nice people, very few Israelis there. After the BBQ party, they aired the first episode of season 2 of Heroes on a big screen, so I stayed to watch.

Next post I’ll talk about the wonders of eBay.

Good news: I have found a place to stay!

Today I started my search for a less temporary place to stay and I immediately found one. The chepest place available answered and had all what I need (bed, electricity, wifi) and for only $450/month. It’s also a short 12 minute drive from my office. After several calls to the landlord and my parents I decided to go for it, without seeing any other places. The room was so cheap because I am barred from any kind of cooking in the room. However, with the money I saved I can eat out every day if I want to. All in all, I think I struck a great deal.

My residential address, if you would like to send me mail, is:

Alon Altman
256 Walter Hays Dr.
Palo Alto, CA 94303
USA

Yesterday I went to Stanford’s compulsory postdoc orientation meeting. In this useless 2.5 hour meeting, we were explained a lot of practical information I have already read online. I didn’t even get my student ID number, as the postdoc office did not receive all my information on time. I also went to the weekly meeting of Yoav’s group and got introduced to all the other researchers in the team.

Later that day, I went to the social security office to get my card replaced to one that is valid for employment. They told me that I must arrive after the start date of my program, which is October 1st.

Today I flew to Stanford. To stay. Here is my story.

I flew with KLM with a connection at Amsterdam Schiphol airport. At Amsterdam, I tried to get admitted to the lounge even though I was not upgraded to business, and did not yet technically qualify for Gold. As I only had 600 miles less than needed, I was granted lounge access. At the lounge I asked for a temporary gold card and they decided to issue one for me even though I did not yet qualify for gold. The actual gold card will be sent to Israel in about a month, and then I’ll ask my parents to forward it here.

On the 747 flight to San Francisco, I enjoyed the best seat on the plane (11F), however when I tried to use the space in front of the seat to sleep in my sleeping bag, a flight attendant told me this is not allowed, so I had to sleep in my seat. I spent most of my time on the plane reading a book I bought and trying to sleep.

We arrived in SFO 10 minutes late, and I was among the first to exit the plane, even before some business class passengers. I rushed to passport control and was admitted without waiting in line at all. The J-1 admission process was longer than usual but I still arrived at the baggage claim area before any luggage came out. After some time, both my suitcases arrived and an airport employee helped me take them off the belt and onto my trolley.

After baggage claim, I took the AirTrain to the car rental building and waited in line. After a short while I got my contract and navigation system and was told to go to the garage and take any compact car. The only problem was, there weren’t any. After 30 minutes of asking several employees in the garage and back outside, I was told to take a midsize car instead. The midsize car was huge. I had no problem loading all the luggage in the backseat and the trunk and installing the navigation system. Finding how to adjust the seat, however, took some time.

After all these adjustments, I entered my destination (Wells Fargo bank at Stanford) and started driving out of the airport garage. For some reason, the navigation system did not update and stayed stuck at the airport. I discovered this only when I was in the middle of an 8-lane road going somewhere I didn’t know. Luckily, there was a traffic jam and I managed to restart the navigation system, which proceeded to recalculate my route and direct me to the bank. I used that traffic jam also to figure out how to close the windows in this car, which is not as simple as it seems.

When the navigation system told me I have arrived, I noticed a large parking lot, so naturally I parked the car there. I saw parking ticket sales machines so I tried to pay for the parking, but it turned out no change was given and the smallest bill I had was $10. So, I decided to head for the bank without paying for parking.

After asking several people and looking around, I finally managed to locate Wells Fargo bank, which were delighted to have me open an account with them. They filled in some forms for me and told me my account will be ready in 15 minutes. So, I changed my $10 bill into ones and went to pay for the parking, just as I paid $1 for the ticket, some girl there told me I don’t have to pay for parking after 4pm. So I headed back to the bank and picked up all the forms and information required to transfer money and also deposited most of my cash.

After finishing with the bank, I went to a small convenience store nearby and bought something to drink. I forgot to mention that while driving I managed to hurt my finger and start bleeding, and since the landing in SFO I had developed a headache, so it was quite hard concentrating on renting the car and opening the account.

With the more important errand settled I could now drive to the motel. I keyed in the address to the navigation system and drove directly to there. I did have to figure out I had to turn into a side street in order to park, though.

I checked in at the motel and paid for 5 nights ($302.5). The room is very small and has almost no closet space, but has hi-speed wireless Internet, a queen-size bed, and a shower and toilet. I brought my luggage into the room, plugged in my laptop and went on line to check email and make some local calls. Then I went to sleep at about 18:30.

I woke up today at 4:30 am, headache free, and ready to start a new day. My plan for this day: blog, unpack, make a plan. Probably I’ll go to Stanford and start settling stuff there.