Facebook Authentication and a Potential Security Risk

The idea of a “universal login” is not new by any means. Since the early days of the internet, many people have longed for the ease of having to only remember one login and password to access all of their favorite member-based sites.

Over the years, there have been a number of companies/organizations that have tackled this problem, and recently a couple of solutions have bubbled to the top in popularity. OpenID, Google Friend Connect, MySpaceID, and even the Twitter Login API have all been used as “universal login” methods which can be integrated with a web site.

None of these solutions, however, have even come close to the adoption rate boasted by the Facebook Authentication system. Practically everyone has a Facebook account these days, regardless of age, gender, education level, location, favorite web browser, email address, or internet provider! Facebook embraced this fact and built a nicely packaged authentication system which enables developers to integrate Facebook Authentication into pretty much any app or web site they can imagine. You can now find the Facebook universal login method in everything from iphone apps and desktop applications, to normal run-of-the-mill web sites.

This brings me to my point: Potential Security Risks

While logging into my Facebook account via all the different web sites and various applications which I use on a daily basis, I became acutely aware of a glaring security risk with the Facebook Authentication system. Basically, the way how Facebook instills a sense of security is via a recognizable blue bar which has a gray bar and diagonal stripes underneath it. This familiar imagery is displayed whenever you are asked to provide your Facebook login information. The idea that is consequently trained and reinforced in end-users’ minds is that the familiar imagery represents a genuine Facebook login screen. As such, if you are being asked for your Facebook information in a login popup, but the unique blue and gray bar is missing, you would immediately suspect that something was wrong.

Notice, however, that the Facebook URL is nowhere to be seen in the login popup. There is literally no easy way to verify where the contents of the login form are actually going. This is especially true in the countless iphone applications and computer programs which are making use of the Facebook Authentication system. A rogue developer could easily create a form which displayed the blue and gray bar, but that actually transmitted the login information somewhere else entirely (such as a database on their own server) before it sent the information to Facebook.

The exact same thing could be easily accomplished by any semi-competent web developer with 15 minutes worth of spare time. All they would have to do is make a mock-up copy of the legitimate Facebook login popup, but have it submit somewhere else entirely. The end user wouldn’t know the difference.

In summary: Facebook’s way of instilling a *false* sense of security via their blue/gray bar is totally flawed and easily exploited. They need to come up with some sort of method which enables end-users to verify the form’s authenticity before they enter their login information.

A Card “Force” Using Unintuitive Mathematical Odds

“A card force is one of any number of methods used in close-up magic to apparently offer a subject a free or random choice of card, when in fact the magician knows in advance exactly which card will be chosen. This can then be revealed later in the trick.”

Premise: We have a set of three cards, all of which are known to us. We attempt to force a specific card on the unsuspecting participant by instructing them to randomly point at one of three cards, which are all laying face down. Theoretically, they have a one in three chance of picking the correct card randomly. If they point at the desired card, we immediately instruct them to flip it, effectively “forcing” the card on them in one try. If this works on the first try, the trick will be especially impressive. However, if it doesn’t work on the first try, we still have a fall-back method:

If they point at one of the other cards, instead of telling them to flip the card, we pretend that they’re playing a game of elimination and we simply remove the card, instructing them to point again. If they point at the next incorrect card, we instruct them to remove it, leaving one final card: the correct one.

Potential downside: If they point at the desired card on the second step, then the “force” fails,
because when we remove it, the end card will actually be the incorrect one.

Cards used: Ace of Hearts (the desired card), Queen of Clubs, and 8 of Spades

Approximate Results After 2000 Simulations:
Times ended on Ace of Hearts: 1322 (0.661)
Times ended on Queen of Clubs: 339 (0.1695)
Times ended on 8 of Spades: 339 (0.1695)

Click here to run the simulations yourself using javascript

Explanation:
Odds of picking the right card during the first step: 1/3. If incorrect card is chosen on first step, we pretend it’s an elimination game and remove the card, leaving only two cards, the desired card, and the incorrect card. At this point, you might think there is an even 50/50 chance they will choose the correct card, but in reality, the odds of them choosing and eliminating the desired card are still 1/3 because it hasn’t been touched. The odds of them choosing and eliminating the second incorrect card, however, have increased to 2/3. This is unintuitive, but the simulation shows it to be true.

Verdict:
Because of the fact that we know which cards are which, we can effectively double our seemingly low 33% odds all the way to 66% simply by using this card force method.

The only unsolved problem is, how do you handle a dead end where someone chooses the wrong card, and then the right card on the second step?

Photoshop Fun – Fake Album Cover

My co-worker, Kent Downer, was showing me some of his facebook photos and one of them jumped out at me. The second I saw it, I just knew I had to photoshop it for fun. Here’s the before and after result:

Photo – Before
(click on photo to see large version):

Kent and Dan on the beach


Photo -After
(click on photo to see large version):

"The Lost Boys" - Album Cover

For a synopsis of the elements used, click here.

Flash 10 Demo

Grant Skinner (gskinner.com) just recently posted this Flash 10 3D music visualizer demo on his “gBlog”. It’s crazy awesome, and even after examining the source code, I’m still not sure how it all works.

For what it’s worth, I went and edited it a bit, removing the music visualizer stuff and just making it spin according to your mouse position over it. Fun stuff. Check it out (P.S. Get Flash 10, Now!):

Hot Air Balloon Ride

This past Saturday, I went on a hot air balloon ride! We went over a mile high, and it was awesome!

My business partner, Chris Tingom, came along (he rode in the other balloon) and he took a video of the experience, and a few photos. I took a video as well, but he beat me to the punch in getting something up online, so I’m just going to show you his stuff for now. At some point, I’ll eventually get mine all edited and up online for viewing, but that could be a while.

Balloon Ride

Balloon Ride

Balloon Ride

Bowling Shoes = Higher Score

Bowling Shoes
Much to the amusement of many of the people I have bowled with, I can’t bowl in a straight line for the life of me. In an attempt to solve the problem I took up experimenting with throwing curve balls, and, after a lot of trial and error, eventually learned how to *occasionally* get the desired effect.

Now, I just want to take a moment to emphasize the fact that I’ve never been a good bowler, probably only bowling a couple of times a year (if that). Even with my best attempts, I have never really averaged more than around 115.

I *do* enjoy bowling, though, so I was pleasantly surprised when my Aunt Pam bought me a pair of bowling shoes as a gift. They are extremely comfortable (maybe even more so than my normal shoes), and fit me perfectly. Bowling shoes usually rent for $3-5, so bowling just got that much more affordable.

Since receiving the shoes, I have gone bowling a couple of times and have been amazed by what a difference they made. Each time I bowled, everything just seemed to click… Literally overnight, my average game went up over 20 points!

At any rate, last week I went bowling with my two buddies, Brian Shaler and John Murch, and I bowled a 201!! Now, I know that a lot of people out there bowl around 200 all the time, but for me that was a big deal (the highest I’ve ever bowled). I even got a print-out of the scores (upon Brian’s recommendation) as proof!

So, yeah. Go get yourself some bowling shoes! :-)