Update: I was subject to the captcha again, and this time I took screenshots.
Update 2: I have created a Facebook group for fighting this security feature. Once you have your account back, join the group and invite your friends!

Facebook has recently and silently introduced a new “security” feature, that does a lot to prevent legitimate users from accessing facebook, but almost nothing to deter determined scammers and hackers.

The security feature works as follows:

Suppose you try to log in to Facebook from a location you don’t usually use, for example when traveling (which is usually when it’s most important for you to keep in touch with friends and family). Facebook asks you to verify your identity.

And how would you do that? First, you have to solve a CAPTCHA. Fair enough, just prove you’re human.

Next, starts the tricky part. You need to identify your facebook “friends” by identifying photos where your Facebook friends have been tagged. In order to regain access to your account you need to solve a CAPTCHA, then identify 7 out of 9 photos of friends. Even a single error fails the test but you do have two “skip”s.

The photos are selected randomly from all photos in which any of your friends have been tagged. If you fail, you can try again within an hour. Returning to a “verified” location does not help once the roadblock has been triggered.

I guess the reasoning behind this: If you are really you, you should be able to identify your friends by their pictures. Right? Wrong! First of all, Facebook (and certain apps) keep pushing you to add more and more distant acquaintances as friends. People who you’re unlikely to even identify by seeing a clear picture of their face. Second of all, people tag each other in photos that are nothing like a clear portait. When I was faced with the challenge I had to tag pictures of feet, pictures of dogs, blurry pictures of people from behind, and “funny” drawings. I am not the only one. Many people have been locked out of their accounts for hours due to this impossible “security” challenge.

Below is an example of one of the worst images I’ve got in my challenge:

The pictures are low resolution, and the pic itself is an xmas card. One of the faces is almost completely obscured by a hand holding a camera. The person in the picture is a work acquaintance I have never met it person, and the worst thing security-wise (and lucky for me) is that the greeting text includes his name!

How did I eventually regain access to my account? The same way any attacker who isn’t me could have. The questions in the challenge are multiple-choice. One or two pictures and five names to choose from. Since my profile is relatively open to the public I could create a bogus Facebook account and see my friend list and their public pages. Most of these include a profile picture which allowed me to try and verify the person. Some have a more public profile where all pictures are available, and then I could find the actual picture from the challenge — just like anyone who isn’t me could have.

After finally succeeding in solving the challenge, I was presented with the oh-so-horrible offensive access. I tried to login to Facebook Chat from the United States. Thanks for being so specific, Facebook.

After guessing this is probably OK comes the next screen asking me to be a fan of Facebook Security. What can I tell you, I am not a fan!

From a security perspective, this is not at all useful. An attacker’s arsenal would include looking up public friend info, and creating a new account with my name and photo, and trying to “friend” all my Facebook friends. With enough people accepting this friendship (which many will), you can access all their photos and easily solve the challenge. In fact, this could be automated, and the only obstacle is several CAPTCHAs that need to be solved, a problem easily solved by spammers using outsourcing or fake “free porn” sites.

Finally, I would like to suggest several other security methods that could actually work:

• Require a user to tag only photos he or she has uploaded, or that he or she appears in. Ask about where or when a picture was taken, and be more lenient.
• Require a user to use an alternative method to contact a few of his or her friends (of the user’s choice) and have them log in can confirm they are OK (for example by giving them some kind of key).
• Get security questions or challenges from the users in advance — something the user knows he or she can solve. Make it clear that these questions are not ONLY for the case of lost passwords.
• Make a phone call or send a text message to a phone number that is in the user’s profile with a key to access the site.

Better still, allow several of these methods at once. Besides, Facebook is not a bank. Just let go of the stupid security.

Here is Facebook’s real world contact information. Call them, send them a letter, or drop by their offices:

1601 S. California Ave.
Palo Alto, CA 94304
USA
+1-650-543-4800 (Phone)

Some have you may have noticed that my blog has a new look. Others may have noticed that the Israeli polyamory forum that I’m hosting has crashed, losing all information. Both of these events have to do with my (paid) hosting account at bluehost.com.

It all started when I wanted to upgrade my ancient wordpress install (with some custom modifications) to a more modern and standard install. So, I backed up my blog and database and proceeded to install the new version. This required a few iterations, each requiring to delete the old instance of the blog.

My major mistake was during one of those installations, I have misclicked and deleted the wrong site — the active poly forum. The delete action did create a backup, but since the database was exported using the wrong encoding, all Hebrew data (including the entire forum) was lost.

I immediately called my hosting provider, but they did not have backups of my account. I never set up a backup script for my hosting account, so the entire contents were lost.

I did reinstall a new forum and the blog. I am now working on a backup solution for my account.

The new blog has several nifty features: On the right sidebar you may find my current exact location. Also, the subscription system should work better and replies could be verified by OpenID.

In my previous post I wrote about my experience with macs, and the conclusion was that in order to criticize macs effectively, I should get one. Over $3,000 and one week later, I got a brand new MacBook Pro 15″ (and a free iPod touch).

The mac came in a brown box, which included a white box inside it. Inside the white box, was the MacBook, the power and video adapters, and a black envelope. Inside the black envelope was a book titled “Everything Mac”. There was also an envelope labeled “Everything Else”. Following the instructions in the “Everything Mac” book I connected the power supply and powered on the mac using the hidden power button. The book included important information about using the TrackPad, stuff I had to figure out slowly in the previous posts.

When the system started for the first time, I was greeted with a language selection screen, and then a welcome video (with no useful information). After the welcome video, I was prompted to press Esc to hear instructions on how to use the mac. I did, however, it started a detailed explanation about an accessibility feature that didn’t even work.

I managed to complete the setup without much difficulty, but no tutorials were provided. According to instructions in the Everything MAC book, I installed software updates, and started to explore. I found a document about “Stacks” and document and download stacks. I also found some online tutorial videos.

One of the things I tried to do with the new mac was use the “Time Machine” backup software. I tried connecting two different external HDs, and got no visual response from the OS for the first, and only the small FAT partition showed up for the second. Reading about it online, I figured that ext3 partitions are not supported, and only plain old FAT drives can be used for backup. Big fail!

Another thing I tried was to download TV shows on iTunes, but I was stumped by the repeated requests for money. I have paid $3000 for a mac, why do I have to pay extra to use it???

As I’ve posted before, I’m staying at a fancy hotel in the Boston area. Next to the hotel is a Mall, and in this mall is an Apple store. Again I tried using the display laptops. If you recall, the laptops have no mouse buttons (the entire pad is a button), which after a short use causes pain in the wrist. The answer I got regarding this issue from “mac people” was: My mac has a button, but I’m sure the no-button pad is just A-mazing, Steve Jobs is God and I am his servant!

So, this time I tried a new approach: I asked a customer service person at the Apple store for help.  The customer service rep didn’t repeat the same “Apple is God” story I get from fanpeople (I guess they are trained to avoid it). Instead, he calmly explained to me another Mac gesture: Hold a finger on the pad while dragging another finger. I had to ask where I find those fingers. It turns out Apple hardware uses unique input devices called “fingers”. The idea is that the trackpad somehow reacts differently to multiple input positions. It turns out this feature is required for basic functionality. Right-click is also supported with the Ctrl button, there is also a multi-finger gesture for that but I’m not sure what it is.

The next thing I tried to do is to replicate functionality I have on Linux on the mac machine. The functionality I decided to try was downloading and playing podcasts. I googled it and the search results pointed me to software called “GarageBand”. I launched it from the dock and selected podcast. It opened a complicated screen with space for male and female voices (why do I have to tell it who’s talking in the podcast?). I decided to try listening to Car Talk from NPR. I used the Safari browser to find the Car Talk podcast, and copied the URL. Then I had to right-click (with Ctrl) on a submenu that said Podcast (why do I have to select podcasts again?), the only option was “open in iTunes”. I know iTunes is spamware for copying music to iPods under Windows but that was the only option. Anyway, the iTunes had an option to add a podcast under the Advanced menu (If that’s advanced, what’s the basic way?). I pasted the URL using SpecialAlt(⌘)-V and confirmed.

Now I could go back to GarageBand and after a few trails I could finally see the podcast there and drag it to the play area. I put it under “Male Voice” since the show is narrated by men.  The GarageBand software seems to be an audio editor like Audacity. I’m reminded of old Windows 3.11 WAV files were opened in sound recorder… Anyway, I clicked the play button and it played! seeking was pretty hard since it was extremely zoomed and there was no way of seeing the entire file in one screen.

I thought to myself there must be an easier way to do it. So I googled “mac podcast player” and found a program called Juice. I installed it, subscribed to Car Talk with the URL, and clicked on the play button. Well, it stated playing. In the background. With the same show of Car Talk still playing in GarageBand. All attempts to stop it didn’t work. I even closed Juice entirely (with SuperAlt-Q, as the customer service guy explained) and still both podcasts were playing. It finally stopped after I SuperAlt(⌘)-Q’d all applications I could find (except GarageBand, and Finder, that wouldn’t close).

Then, I decided to see if GarageBand can export to a mobile device. The whole idea of podcasts is to listen to them on the move! So, under the share menu there was something about Podcasts and iWeb. I clicked that, and the podcast stopped playing and moved to the start, forgetting my playback location. Good thing I remembered what it was and seeked back there manually (the export failed BTW).

After all those trials, an Apple guy finally approached me, and told me — that the store is closing and I have to leave. I asked why is the GarageBand thing so complicated, and he said that I should use iTunes to play podcasts. He couldn’t explain more since I had to leave.  That’s all for now.

PS: I forgot to mention the fact that keyboard shortcuts don’t work as expected, the Alt-F4 Expose settings screen for example, says that expose could work F9, F10, and F11. Instead, those buttons adjust the volume! It turns out the real shortcut is F3! But I found that out only after coming back to my room. Amazing documentation from Apple, yet again.

PPS: I even thought I’d buy one just to see how it works, but an Apple laptop costs over $7,000, and for that price it’s only a 256GB hard drive. What is it made of? Solid Gold? And you still have to pay extra for backup hardware (yes, macs need special $500 hardware to enable backups). It seems like macs are the fancy hotels of the computer world — anything you want to do costs extra.

PPPS: I suspect Apple puts addictive substances in their products. That’s the only way I can explain why anyone who’s purchased an Apple product seems to be in love with it. On a more serious note, I think the main driver for people loving Apple products in cognitive dissonance — You don’t want to admit to yourself you significantly overspent for a product that is no better than others, and since things aren’t customizable, people convince themselves they like it that way.

I promised a second post about macs, and it’s time to deliver. The reason I’m updating about it now, is that it turns out that two of the undergrads working with me on the computational pool project are mac people, and use mac laptops. Whenever I explain to them why macs are hard to use and complicated they keep saying I’m doing it wrong, and there’s a better way to do it. My main complaint here that this “better way” is never documented and isn’t easy to find.

For example, one mac person in our group re-installed a mac machine that was sitting in my office after the HD died (it required a trip to the shop to replace, since mac hardware is hard to maintain, and this is desktop!). After he left, I tried using his machine, the first thing I was greeted with was a screen asking for a password. That’s not very user friendly!

So, I googled for password reset information. I found several sites explaining how to reset a password without the CD, but all required you to be already logged in. I realized, it must be possible with the CD. However, there was no apparent way to boot from CD. Heck, there was no apparent way to get the CD out of the drive. Later I found the eject button on the keyboard, but still the computer will always boot from HD. I googled “mac boot from cd” and found you need to hold the option button while booting, not del of F1 like normal computers, and of course no message on boot to tell you that.

I booted the install CD, and it had a password reset option, but it didn’t work, since it wasn’t the right version. I had to boot an upgrade CD in order to successfully reset the password. After the password was reset I could finally log in.

Next step was to create a user for myself. This was not easy. The “spotlight” search feature I was told so much about did not work since it was “indexing”. I finally found the user management from the control panel and created my user.

All this time I was interrupted with an annoying window that wouldn’t close saying “Welcome” in different languages. Same annoying pop-up junk as with Windows. After that was done, an “install updates” popup came up and it had to restart and install the updates. By the time I was writing this post, the updates have finally been installed. I will now try to log in.

I am now on the mac itself. I managed to install Adium and Firefox. As it turns out, the popup window that appears is a mounted virtual drive. The two icons represent the application and a shortcut/symlink (I’m not sure) to the “Applications” folder, which is similar to the Start menu in windows. Dragging one to the other launches an install script, though I’m not sure exactly how. After installation is done you must unmount (“Eject”) the disk image in order to use the application. The application itself is only available from the applications menu, which can be accessed by searching for “Applications” using the magnifying glass on the top-right of the screen (called “Spotlight”). Spotlight does not search the web, or for uninstalled applications.

You could also  use spotlight to search for a specific application. In a way, it’s like a limited graphical command line. The most important application to locate with Spotlight is the real command line (called “Terminal”). This application will later appear on the bottom of the screen, and as I found in the book “Mac OSX or Unix Geeks”, you can drag it do a different position on the bottom of the screen to have it stay there. I did not find a similar way to add a non-running application.

Another discovery I’ve made: The screen has a hidden camera near the top, I guess Apple literally watches you. More to come soon.

Tried to install Hebrew. Worked, but without a keyboard shortcut. Any attempt to enable launched a monster keyboard shortcut menu, where it turns out that Hebrew conflicts with the “spotlight” thing. So, it’s either Hebrew or being able to launch applications. Updates to come.

As I have posted before, my brother has recently had twin daughters, which made me a new uncle. As many of you know, babies and I don’t get along very well. I mean, they like me, but I’m very much afraid of them and have no idea what to do with them.

Well, for some obscure reason, I guess mostly to laugh at my feeble attempts, they have placed one of these 3-month-old babies on me. Within a few minutes, she has already has vomited some kind of white substance on my clean t-shirt. I decided to learn more about these weird creatures, so I did what I usually do.Used Google.

Well, I made a series of web searches, but none returned any useful results. I am usually pretty good at web searching. I wasn’t sure where I went wrong. Many searches resulted in google scholar papers, but none included detailed enough instructions for beginners. Not to mention the fact that the product itself is not user-friendly. More about that below.

human baby “user’s guide”
human infant “user’s guide”
human infant manual
human infant safety
human infant care
human infant maintenance
human infant maintanence
human infant upkeep
baby uncle guide
new uncle guide
human baby care
human offspring care
human offspring maintenance
human offspring maintenence
human baby upkeep
human baby maintenance
human baby maintenence

Never mind Google’s failure here, the product itself is a UI nightmare. No manual included, no labels of any kind on the very delicate parts. No warnings. No warranty (except as required by the state), and it’s not even eligible for return or replacement.

It seems that human infants have a significant negative influence on humans, rivaled only by that of cats:

I, for one, seem to be immune to that negative effect (of cats too). However, I still cannot overcome the effect of two babies in my vicinity on all other humans, making having fun, such as playing board games, or having meaningful conversations, virtually impossible.

This post is a public service announcement: Use birth control. Because most STDs are manageable, babies aren’t!

As for me, I’m considering a vasectomy…

If you had to name the two most common operating systems, you would most likely say: Windows and Linux. Well, in the US there is a third common operating system. In fact, it’s even more popular than Linux. It’s called MAC OSX. In the Bay Area, not far from Cupertino where Apple Computer is headquartered, Macs are very common. It sometimes feels like more people use Macs than Windows.

Macs are supposed to be easy to use and intuitive, so I tried using one in my local Apple Store in Palo Alto. They have working laptops there than anyone can come and use.One of the first things I’ve noticed was a lack of mouse buttons. We’ve all heard about Macs have only one button, well the new ones don’t even have that. The trackpad is the button, and there is no right or middle button. Dragging requires manual effort to keep the heavy trackpad pressed, and if you’ve reached the end of the pad, you’re out of luck. Can’t just hold the button.

Another thing lacking was a scrollwheel, the standard right-side-of-pad scrolling didn’t work. I  happened to find by chance that you can scroll on a Mac by using two fingers on the trackpad. It’s weird but it works pretty well.

The other input device I was having trouble with was the keyboard. Ctrl combinations don’t seem to work, and there are no PgUp/PgDown keys. I had to ask to know that most Ctrl combinations are replaced with a new key called “command” (it’s similar to Meta), though some things like ctrl-left/right to move a word back and forth is actually with the alt button, which is also labeled “option”. The PgUp/PgDown require yet another modifier key “fn”. The total of five modifier keys leave little space for the space bar, and the most useful one (“option”) is not near the edge of the keyboard as one might expect, but near the spacebar.

One of the first things I tried to do was install FireFox and an IM client called Adium (I googled “mac IM” and that was the first result). Software installation on Macs is different from Linux or Windows. Downloaded files are “Disk Images” (something like an ISO) which you have to mount. Then, (and this is never explained, I had to ask), you need to drag the application icon to a nearby icon of a capital “A”. I tried to attach a screen cap of that but the capture application only saves to TIFF.

Anyway, even after you install the software, it only appears in a secret menu called “Applications” that you need to do the following to reach: Click on the desktop, click on the “Go” menu, click on “Applications”, browse to the application among a whole lot of stuff (like the “Programs” menu in Windows, but not sorted by vendor). The terminal BTW is under another sublevel “Utilities”. No wonder I couldn’t find it.

Now, I tried to look for some tutorial to explain these basic features. I found a help page about transitioning from windows that didn’t explain anything (such as scrolling, or the “command” button, or how to install or uninstall software).

I can talk all day about how non-standard Macs are. The close/minimize/maximize buttons are on the LEFT and are only color coded (red=close, yellow=minimize, green=maximize). Alt-F4 and other common combos don’t work (well, it opens an “Expose Settings” screen). Command-F4 doesn’t work either. It seems the combo is Command-W (I guess W is for Wlose, or they copied it from Firefox’s close tab combo). I tried some of the pre-installed software too, but about that in a future post.

Update: I figured out how to use an image conversion program called “Preview”. It seems Macs copy the awful Windows default of hiding extensions, so I had to guess what version of the image I’m uploading…

Last Saturday, I went to the Vertical Challenge Helicopter Show at the Hiller Aviation Museum San Carlos airport. The show included admission to the museum and an exhibition of military and civilian helicopters. The main event included helicopter aerobatic demonstrations, RC Helicopter presentations and a search & rescue demonstration by the US Coast Guard.

After the show, I came back home, realized it was really hot, in spite of the fact I’ve ordered a fan off Amazon the day before. It seems fans don’t really work before they are delivered, and this particular Amazon order would take two weeks to arrive. After checking the options of faster shipping, I suddenly recalled a different way to get products: Retail. A Home Depot was less than 5 minutes from my home, at I verified online that they indeed stock fans. A short trip back and forth and a fan was in my possession. A few minutes later, it was assembled the room was significantly cooler.

Later this week, on my way to Stanford, the police have suddenly stopped me. The officer explained that I was driving 40 in a 25 zone (this is MPH, so it’s actually 65 in a 40 zone in kilometers) and gave me a ticket. The officer was not able to say how much the fine was, so I will know that only when I get the ticket in the mail.

Upon reaching Stanford I had a positive surprise. My laptop, that I’ve ordered two months before, has finally arrived and works great. I took it home to complete the installation and it will soon replace my old one. Expect being able to video-chat with me any time day or night (assuming I’m online and you have skype).

This weekend features Paul’s boardgaming extravaganza and BAP’s games day. Next weekend is the 4th of July, aka Independence Day. Stay tuned.

P.S. Thank you all for purchasing stuff via the DealExtreme links in my last post. I got more than 20 points already. If you did buy anything, please comment and tell me what you got. Thanks!

I have recently discovered an amazing website based in Hong-Kong selling tech gadgets at amazingly cheap prices: cables, adapters, and any type of USB gadget you could think of all in ridiculously low prices and free worldwide shipping. On the first day I ordered 7 different products in 6 separate orders. On the next days, I ordered 13 more items for a total spending of $89.

The name of the website is DealExtreme. And the things I bought are:

• XTY Operator Style Earbud Microphone Set
• FM Radio with Headphones (XIBOMAN AS-875)
• IR Remote Controlled AC Outlet for Appliances (very cool!)
• Digital Body Thermometer
• Mini Dice (50-Pack)
• Network Retractable Cable
• SD/MMC Memory Card Reader
• Travel All-in-one Universal AC Adapter
• Designer Digital Pedometer
• Air Inflated Neck Cushion Sleeping Pillow
• Rechargeable Batteries AAA
• Rechargeable Batteries AA
• Maxuss 4 x AA/AAA Charger for Ni-MH Batteries
• Ultra-Small LCD-Mount 1.3 Mega Pixel PC USB Webcam (Driver-Free)
• USB Convertor Cable Flying Saucer
• USB to Audio Crystal Blue Sound Card
• USB 1.1 A to B Cable (1.5-Meter)
• Universal TV Remote Controller Keychain with LED Flashlight x2
• KS-8088 Designer Rechargeable Electric Shaver (110V~240V AC)
• USB LED Cooling Fan
• Cute Handheld Cooling Fan (2*AA)

I hope you all enjoy this amazing site, and if you do buy something, please click on my links, as I get referral points.

The story starts nine months ago, on my first arrival to the United States. From the start I knew I have to get myself a cellphone and thus I have bought an iPAQ and a T-mobile prepaid SIM card. However, the SIM card was sold without the PIN code required to make changes to the account. This was not a problem for me, as I could still use the phone and add minutes.

Three months ago, I decided that I will spend more than a total of $100 in a year and thus I could load up to a $100 immediately and get extra benefits: 15% more minutes, and the minutes expire only after a year. Assured of my new “gold” status, I did not buy any more refill cards.

And then, suddenly, yesterday I discovered that my balance of more than $50 became 0. I called customer service and they explained that the 1-year expiration applies after the NEXT refill after I qualify for gold, but she agreed to credit my $50 back. All she needed was to confirm my identity with the PIN I did not have. She said I will have to identify myself at a T-Mobile location and get a new PIN before I could get my minutes back.

As I neeed to make a call right away, I added $10, immediately losing 35 cents for not buying the card as Safeway, and decided I’d go to a T-mobile location the next day. At the T-mobile location, I asked to confirm my account, but they said that my ID must match the name on the account. After several minutes of asking for help, I asked them to check whether or not my name is on the account. It turns out it was, and new PIN was assigned. Now all I had to do was call customer service and have them credit my minutes.

Well, in case any more problems will arise, I decided to call customer service from the T-mobile store. After a short wait, the rep told me that they cannot credit my account since more than 48 hours have passed since the balance expired. I asked to speak with a manager, they complied, leaving me on hold for at least 30 minutes. While on hold, I called them back from my cell phone and got the same reply from two additional reps, asked to talk to the manager, and got disconnected, and then tried again.

After more than 30 minutes of waiting, the final rep managed to get their supervisor to credit my account. An amazing waste of time and money for just $50 that were rightfully mine. Once I deplete my balance I will seriously consider switching to another provider.

T-mobile and the color Magenta are registered trademarks of Deutsche Telekom.