User Data Compromised on Alfa Portal

It has been several months, if not well over a year since I logged into my account on www.alfa.com.lb, the official site of Alfa (managed by Orascum) one of the two local mobile providers.

I was curious today to check some parts of the portal, and as I logged in and was redirected to my own account info, I discovered, to my amazement, that although my password had remained unchanged, and my mobile number was still associated with my username "patrick", the entire profile was wrong and showed someone else's info.

I have to give you a brief background on why this is important for me. Back in my early career in the year 2000 (read it like Conan O'Brien would) I was the lead developer with Cellis -France Telecom when the portal was created under the name Plugged.
I also was the lead on the portal re-branding into what was the basis of its current form heading the Web Development in the company until the time I left in 2011 when I started my own venture Sharp Lemon.

My username had been coveted several times in the past, maybe for its simplicity, but I only used to get "password reset" requests, until those requests stopped and I figured that, most likely, no one is sending Web-to-SMS anymore, and perhaps Alfa have implemented a stringent login process since then.

My discovery below surprised and worried me for one major reason:
I know, from first hand experience with the Bureau of Electronic Crime, that SMS sent from the Alfa portal make the account holder liable for the info sent from it, in cases of breach of law (harassment, threats or any illegal activity). So, imagine the implication if someone had access to your Alfa account. It also meant they could see vital information regarding your phone calls and other activities.

I personally believe the portal suffers or has suffered from a serious vulnerability, that has allowed someone to modify profile information, without accessing passwords, which were according to my knowledge hashed in the database.
The other, more benign, alternative is that during some internal data migration, Alfa have really messed up some data sets and people's profile info ended up associated other persons' accounts.

I have since updated my info, although I cannot seem to find a link to where I can update my password. It's either dug in so deep or someone has considered that changing a password is a feature not really necessary for a site of this caliber.

Either way, this is an alarming incident for me and I invite you if you have used or are still using the alfa's portal to check your account and let me know in the comments if you have faced similar incidents.

Too bad Alfa, just when I was starting to think you had gotten your act together again finally!

Photo Showcase on Hayda Loubnan by LBCi

A few month back I was approached by the producers of a segment entitled Hayda Loubnan on LBCi. The segment showcases photos mostly by amateurs taken all over the country, highlighting unique angles or takes on every day Lebanon and its nature.

I am as amateur as it gets, and I have recently become more and more dependent on mobile photography, simply because the hardware on smartphones had improved by giant leaps, and, quite frankly, because carrying around a DSLR Camera is plain cumbersome. I take my photos mostly on mountain hikes and I just prefer to enjoy nature rather than worry about an expensive camera around my neck for 7 or 8 hours.

My surprise in receiving that call was quickly dissipated when I found out that had discovered my photos on www.EyeEm.com a photo sharing Instagram competitor which I strongly prefer.
Several months into this and many photos later, I received a confirmation that my segment would air on October 24th 2014 and so it did.

I would like to thank the producers and LBCi for the opportunity of getting effortlessly featured on TV simply by doing two things I really enjoy: Hiking & Photography

A special thanks to the @LBCI_FansSs twitter account for sharing the YouTube version of the segment.

The photos and hikes would not have been possible if it weren't for the wonderful people at Born2Hike

Inbox By Gmail, A Contender To The Throne

When the new Inbox application by Gmail was announced a few days ago, I got so trigger-happy in sending the email requesting an invitation that I requested the invite twice from my personal Gmail and from my Business Google Apps account (more on that last one later).
But I had been through this experience before (Ingress, Google Gallery...), and it can be really lengthy, so I did what any self-respecting technology-dependant person would do: I shamelessly intruded on one of the nicest guys I know, who also happens to work at Google, and pleaded my case.
I make it sound way more dramatic that it actually was, since the Inbox invite landed quite quickly in my inbox (see what I did there?) with a "You're welcome" and a big smile.

It's been almost 24 hours since I installed Inbox and I am surprisingly quite won-over compared to my usual resistance and cynicism as to why an app would want to re-invent an existing app that does pretty much everything one needs. I had been nothing but constantly gladly surprised by the Gmail app and Inbox was giving me the jitters.

Bottom line, it works!
It just works gracefully and smoothly sorting out flawlessly existing emails in your inbox into various labels such as Travel, Purchases, Finance, Social, Updates, Forums, Promos while allowing you to create your own bundled label under your inbox. Your existing filters and old labels are still shown as unbundled labels.
Material design oozes from every element of the app and its web counterpart (yes you get a web interface at inbox.google.com once you get your invite). The compose button is a much welcome deja-vu from Google+. The web version maintains Hangouts integration while inconspicuously tucking it in under an icon in the header Google bar.

My main concern using the app was how it reflects on my existing inbox. Would sweeping an email or a folder delete it, hide it, archive it? I quickly found those answers using the Getting Started documentation.
Notifications are now center-stage in the Inbox app and I wanted to see how it all fits in with Google Now, so I set a reminder using voice command and surely enough when I switched to Inbox it was showing prominently on top.
One interesting feature that seems present although I did not have the chance to test is the location based notification when the app detects a geographically-linked action in your inbox.

When Trying to Access
your Google Apps Email

What Inbox still lacks are mostly all the bells and whistles we've grown accustomed to in Gmail:

• No integration with Google Drive for attachments,
• No custom notification sound, although bundled labels do have some advanced notification settings
• No settings for auto image downloading
• No auto responder or signature
• No settings for turning on  and off the Reply All option.
• No availability for Google Apps 

The lack of features might be unsettling at first but given the fact we are still at the early release stages of Inbox, I am pretty sure that plenty more enhancement are still on the drawing board. Along with all the feedback that will be pouring in, Inbox seems all set to be a serious contender for the throne of email apps.

Facebook takes a Page Out of a Lebanese Developer's Book

image source: http://newsroom.fb.com/news/2014/10/introducing-safety-check/

This morning Facebook's founder Mark Zuckerberg posted an update announcing "Safety Check", a new service that would allow people in times of natural disasters to inform their friends that they are safe or whether they need help.

Post by Mark Zuckerberg.

This is a big move by Facebook in terms of serving the public and a much welcome initiative.
In Lebanon, we have been spared the natural disaster scenarios for some time. Aside from the occasional highway flooding, and road blocked by snow, we have had a smooth ride for the past few decades in that area. Instead we prefer man-made disasters, and for those of you who have not heard of the on-and-off streaks of bomb attacks on various suburbs in the past  few...er...decades, that's something that we've adapted to over and over and again.

In recent years with the surge of yet another wave of bombs a young lady by the name of Sandra Hassan coded and published an Android app that with a click of a button would allow anyone to publish a quick message saying "I am Alive" on Facebook and Twitter. I recently had the opportunity of  highlighting the importance of such an app while speaking at an EU sponsored workshop in Cyprus for Civil Protection.

I am not sure we'll ever know if Facebook got inspired by this app, given the good number of Lebanese talents on board, or whether this is something that has been in the pipeline for some time but the similarity was worth highlighting.

So there you go,  my contribution to stroking the proverbial Lebanese ego and one more opportunity at gloating the usual "we did it first" and "do you see what Lebanese can do?".
Now you can bask in the sunshine of your self-satisfaction and wait for next earthquake to test out the new service or just read about it here: http://newsroom.fb.com/news/2014/10/introducing-safety-check/

Social Media To The Rescue For Civil Protection

Civil Protection or as we know it in Lebanon, Civil Defense, is a household name that often bring a sigh of relief for people involved in various incident or disasters; and we have had our share of those in Lebanon.

When recently approached by the organizers of the EUROMED PPRD SOUTH II PROGRAM to deliver a workshop on the effective use of social media for risk awareness and recovery I was thrilled by the opportunity to do something meaningful away from the usual freebie giveaways and brand mongering that seem to dominate the social media scene.

Set on day 2 of a two-day workshop in Cyprus, aimed at delivering added value and hands-on knowledge to select countries of the Mediterranean basin, my contribution was intended to bring the fine members of the individual civil protection societies up to speed with the latest trends and best practices for effectively managing their chosen social media channels.

Through a breakdown of the pros and cons of each channel, and its effectiveness in delivering proactive awareness messages versus its usefulness in immediate response to crisis, a real brainstorming session took place that helped shed valuable light on present practices and recalibrate the individual efforts of some countries.

The invaluable work done by "Donner Sang Compter" was featured as an example of how to do things right both on and off of social media, and the cynical yet effective application IAmAlive along with its tongue-in-cheek version for VIPs helped wrap up the session and define the influence of social media in our lives in times of crisis.

I was glad to see that the attendees took interest in the information received and voiced many of their concerns and interests in the Q&A session. [End of shameless self-promotion]

It is very exciting when age-old entities, that are often very traditional in their modus operandi, opening up to new work methodologies and striving to utilize the full potential of new tools such as social media channels. The Lebanese Civil Defense delegation assured me they were very interested in pushing their existing presence even further and fully embrace technological advances. I hope they won't have to go through too much red tape to do this.

I want to strongly thank Véronique Ruggirello and the organizers from the PPRD team and Civipol for their warm welcome and followup on every aspect of my trip and presentation and mostly for the insightful and fun time we spent in between working sessions.

You can find my presentation on Slideshare