Facebook FriendPhotoCaptcha Roadblock

Update: I was subject to the captcha again, and this time I took screenshots.
Update 2: I have created a Facebook group for fighting this security feature. Once you have your account back, join the group and invite your friends!

Facebook has recently and silently introduced a new "security" feature, that does a lot to prevent legitimate users from accessing facebook, but almost nothing to deter determined scammers and hackers.

The security feature works as follows:

Suppose you try to log in to Facebook from a location you don't usually use, for example when traveling (which is usually when it's most important for you to keep in touch with friends and family). Facebook asks you to verify your identity.

And how would you do that? First, you have to solve a CAPTCHA. Fair enough, just prove you're human.

Next, starts the tricky part. You need to identify your facebook "friends" by identifying photos where your Facebook friends have been tagged. In order to regain access to your account you need to solve a CAPTCHA, then identify 7 out of 9 photos of friends. Even a single error fails the test but you do have two "skip"s.

The photos are selected randomly from all photos in which any of your friends have been tagged. If you fail, you can try again within an hour. Returning to a "verified" location does not help once the roadblock has been triggered.



I guess the reasoning behind this: If you are really you, you should be able to identify your friends by their pictures. Right? Wrong! First of all, Facebook (and certain apps) keep pushing you to add more and more distant acquaintances as friends. People who you're unlikely to even identify by seeing a clear picture of their face. Second of all, people tag each other in photos that are nothing like a clear portait. When I was faced with the challenge I had to tag pictures of feet, pictures of dogs, blurry pictures of people from behind, and "funny" drawings. I am not the only one. Many people have been locked out of their accounts for hours due to this impossible "security" challenge.

Below is an example of one of the worst images I've got in my challenge:

The pictures are low resolution, and the pic itself is an xmas card. One of the faces is almost completely obscured by a hand holding a camera. The person in the picture is a work acquaintance I have never met it person, and the worst thing security-wise (and lucky for me) is that the greeting text includes his name!

How did I eventually regain access to my account? The same way any attacker who isn't me could have. The questions in the challenge are multiple-choice. One or two pictures and five names to choose from. Since my profile is relatively open to the public I could create a bogus Facebook account and see my friend list and their public pages. Most of these include a profile picture which allowed me to try and verify the person. Some have a more public profile where all pictures are available, and then I could find the actual picture from the challenge -- just like anyone who isn't me could have.

After finally succeeding in solving the challenge, I was presented with the oh-so-horrible offensive access. I tried to login to Facebook Chat from the United States. Thanks for being so specific, Facebook.

After guessing this is probably OK comes the next screen asking me to be a fan of Facebook Security. What can I tell you, I am not a fan!



From a security perspective, this is not at all useful. An attacker's arsenal would include looking up public friend info, and creating a new account with my name and photo, and trying to "friend" all my Facebook friends. With enough people accepting this friendship (which many will), you can access all their photos and easily solve the challenge. In fact, this could be automated, and the only obstacle is several CAPTCHAs that need to be solved, a problem easily solved by spammers using outsourcing or fake "free porn" sites.

Finally, I would like to suggest several other security methods that could actually work:

• Require a user to tag only photos he or she has uploaded, or that he or she appears in. Ask about where or when a picture was taken, and be more lenient.


• Require a user to use an alternative method to contact a few of his or her friends (of the user's choice) and have them log in can confirm they are OK (for example by giving them some kind of key).


• Get security questions or challenges from the users in advance -- something the user knows he or she can solve. Make it clear that these questions are not ONLY for the case of lost passwords.


• Make a phone call or send a text message to a phone number that is in the user's profile with a key to access the site.

Better still, allow several of these methods at once. Besides, Facebook is not a bank. Just let go of the stupid security.

Here is Facebook's real world contact information. Call them, send them a letter, or drop by their offices:

1601 S. California Ave.
Palo Alto, CA 94304
USA
+1-650-543-4800 (Phone)

Licensed!

Today I got a license. Not for software, but a driver's license. As of today, I am a fully licensed driver in the state of California. As I have mentioned earlier, I had to pass both a written and a driven exam. Today I passed the driven exam and immediately got a temporary license.

My plastic license will be mailed in 10 days, and then I will be just like any American with a Social Security Number, credit and debit card, and a driver's license. I can't vote and don't have a US passport, but then again, most Americans don't vote or have a passport either.

Errand day

After returning from Mexico, I had a lot of things to take care of. I got lots of mail in my office: A new miniSD card and a new SIM for my iPAQ, an American Express credit card, a and VISA debit card. I also had to print a paper I have to review and read a backlog of Hebrew e-mails I couldn't read on my iPAQ (I still have a backlog of blog posts to read).

After taking care of all that in Stanford and eating lunch, I headed for the Social Security office in Redwood City. After I few wrong turns I have finally arrived and had to wait in line for about an hour, so I read the paper I have brought with me. When my turn finally arrived, I submitted the form and was told I'd get a social security card that's valid for employment in six weeks, however the number will remain the same.

Two blocks from there is a California DMV office, where I applied for a driver's license and passed the written exam (with only one mistake). I was issued a temporary license on the spot and scheduled a driven test for two weeks later.

After finishing these errands, I returned to Stanford and joined another event of the Stanford Jewish community, held in the Sukkah. There I met another new post-doc (only a week here) that knew me from FishEye. I told him some useful information about getting a car and a driver's license and we exchanged e-mails.

The event ended at 9pm, and it was just time to go see House on FOX. It seems that the TV method of seeing shows has the major disadvantage of having commercial breaks interleaved with the show, however you can see shows only 3 hours late (we're on the west coast) and before they arrive on file sharing.

Today I came to the office early as I forgot the charger of my iPAQ and my battery has run out. I'm still waiting for the extended battery I ordered to arrive. No special plans for today, though I do plan to begin doing actual research.

P.S. check out the posts from Mexico, as I have added links and pictures.

New car, new friends

I haven't updated in some time. You don't have to worry. I'm doing fine. Yesterday I picked up my brand new blue 2008 Toyota Yaris, all paid for and insured. So now I have a car and a place to live. I got a good deal on the car and paid only $16,300 for it including all taxes.

Today I bought a parking permit for the car, so now I can actually park on campus. I also finally got my student number and ID card, and my network ID, so now I can use my laptop anywhere on campus.

I have done other stuff this weekend. On Sunday I went on a short hike to "the dish", a radio-telescope here at Stanford and made some new friends from all over the world.

I was also told about a BBQ at the Jewish center here at Stanford on Monday night so I went there as well. Many nice people, very few Israelis there. After the BBQ party, they aired the first episode of season 2 of Heroes on a big screen, so I stayed to watch.

Next post I'll talk about the wonders of eBay.

Residential Address

Good news: I have found a place to stay!

Today I started my search for a less temporary place to stay and I immediately found one. The chepest place available answered and had all what I need (bed, electricity, wifi) and for only $450/month. It's also a short 12 minute drive from my office. After several calls to the landlord and my parents I decided to go for it, without seeing any other places. The room was so cheap because I am barred from any kind of cooking in the room. However, with the money I saved I can eat out every day if I want to. All in all, I think I struck a great deal.

My residential address, if you would like to send me mail, is:

Alon Altman
256 Walter Hays Dr.
Palo Alto, CA 94303
USA

Yesterday I went to Stanford's compulsory postdoc orientation meeting. In this useless 2.5 hour meeting, we were explained a lot of practical information I have already read online. I didn't even get my student ID number, as the postdoc office did not receive all my information on time. I also went to the weekly meeting of Yoav's group and got introduced to all the other researchers in the team.

Later that day, I went to the social security office to get my card replaced to one that is valid for employment. They told me that I must arrive after the start date of my program, which is October 1st.

Arrival

Today I flew to Stanford. To stay. Here is my story.

I flew with KLM with a connection at Amsterdam Schiphol airport. At Amsterdam, I tried to get admitted to the lounge even though I was not upgraded to business, and did not yet technically qualify for Gold. As I only had 600 miles less than needed, I was granted lounge access. At the lounge I asked for a temporary gold card and they decided to issue one for me even though I did not yet qualify for gold. The actual gold card will be sent to Israel in about a month, and then I'll ask my parents to forward it here.

On the 747 flight to San Francisco, I enjoyed the best seat on the plane (11F), however when I tried to use the space in front of the seat to sleep in my sleeping bag, a flight attendant told me this is not allowed, so I had to sleep in my seat. I spent most of my time on the plane reading a book I bought and trying to sleep.

We arrived in SFO 10 minutes late, and I was among the first to exit the plane, even before some business class passengers. I rushed to passport control and was admitted without waiting in line at all. The J-1 admission process was longer than usual but I still arrived at the baggage claim area before any luggage came out. After some time, both my suitcases arrived and an airport employee helped me take them off the belt and onto my trolley.

After baggage claim, I took the AirTrain to the car rental building and waited in line. After a short while I got my contract and navigation system and was told to go to the garage and take any compact car. The only problem was, there weren't any. After 30 minutes of asking several employees in the garage and back outside, I was told to take a midsize car instead. The midsize car was huge. I had no problem loading all the luggage in the backseat and the trunk and installing the navigation system. Finding how to adjust the seat, however, took some time.

After all these adjustments, I entered my destination (Wells Fargo bank at Stanford) and started driving out of the airport garage. For some reason, the navigation system did not update and stayed stuck at the airport. I discovered this only when I was in the middle of an 8-lane road going somewhere I didn't know. Luckily, there was a traffic jam and I managed to restart the navigation system, which proceeded to recalculate my route and direct me to the bank. I used that traffic jam also to figure out how to close the windows in this car, which is not as simple as it seems.

When the navigation system told me I have arrived, I noticed a large parking lot, so naturally I parked the car there. I saw parking ticket sales machines so I tried to pay for the parking, but it turned out no change was given and the smallest bill I had was $10. So, I decided to head for the bank without paying for parking.

After asking several people and looking around, I finally managed to locate Wells Fargo bank, which were delighted to have me open an account with them. They filled in some forms for me and told me my account will be ready in 15 minutes. So, I changed my $10 bill into ones and went to pay for the parking, just as I paid $1 for the ticket, some girl there told me I don't have to pay for parking after 4pm. So I headed back to the bank and picked up all the forms and information required to transfer money and also deposited most of my cash.

After finishing with the bank, I went to a small convenience store nearby and bought something to drink. I forgot to mention that while driving I managed to hurt my finger and start bleeding, and since the landing in SFO I had developed a headache, so it was quite hard concentrating on renting the car and opening the account.

With the more important errand settled I could now drive to the motel. I keyed in the address to the navigation system and drove directly to there. I did have to figure out I had to turn into a side street in order to park, though.

I checked in at the motel and paid for 5 nights ($302.5). The room is very small and has almost no closet space, but has hi-speed wireless Internet, a queen-size bed, and a shower and toilet. I brought my luggage into the room, plugged in my laptop and went on line to check email and make some local calls. Then I went to sleep at about 18:30.

I woke up today at 4:30 am, headache free, and ready to start a new day. My plan for this day: blog, unpack, make a plan. Probably I'll go to Stanford and start settling stuff there.