The first day I disregarded it, re-typed my new (but barely different) password, and went on my merry way. By the third day I was wondering if somehow Facebook was detecting the fact that I was getting my password wrong, but only by a single character (after all, I was), and interpreting it as a typo and showing me this message even though it wasn’t the “email or username” that was wrong.

How would that work? Well, I don’t know. Of course, computers can detect when one word is similar to another (i.e. a typo, like when Word shows a red line under a mistyped word), but every web developer knows you never store users’ passwords–instead you (usually) store a cryptographic hash of the password, which can never be reversed to find out the password. This is a big topic I can’t do justice to here (if you’d like there’s lots to learn at Wikipedia), but suffice it to say a normal hash can’t be compared to a wrong password to see if it’s just a typo. I wondered if Facebook’s engineers had implemented some kind of advanced hash that makes such comparisons possible, but in the end it was moot—because I was wrong. Facebook wasn’t looking at my password at all.

See, I was making an assumption: that I was typing my username correctly. Could I be so dumb? Actually I thought I was being kind of clever. See, Facebook allows dots (periods) in usernames. Mine is jordan.running. But when you type in a Facebook profile URL it doesn’t really care about the dots. Whether you go to facebook.com/jordanrunning or /jor.dan.run.nin.g it’ll cleverly redirect you to the right place, i.e. facebook.com/jordan.running. This knowledge in hand, I’ve always just typed “jordanrunning” (no dot—a keystroke saved is a keystroke earned) into the login form and gotten in just fine, even though I had typed the “wrong” username. So I assumed that Facebook considered “jordanrunning” to be wholly equivalent to “jordan.running” for logging in, and that the message I got was due solely to my new password. But then I tried using my “real” username, with the dot, and my old password, and I got a different message:

So what’s happening? Finally it dawned on me, and I felt dumb for not realizing it right away: With a cookie, Facebook remembers the last person who logged in on your computer, even if that person logged out. If a login fails—regardless of whether it’s the username or password that’s wrong—it checks the cookie first, and if it sees that the username that was typed in is a likely typo for the last logged-in username, it shows the “you entered a slight misspelling” message. Sure enough, when I tried the same steps in a Chrome Incognito window (no cookies) I got the incorrect password page instead of the typo page. I’d expect the same result on a computer (or browser) I’d never used before–unless the last person to use it had a username really similar to mine.

Confused? Here’s a flowchart of what (I think) the Facebook authentication process looks like (click to embiggen):

It’s interesting to see how much thought has gone into a feature seemingly as simple as “we think you made a typo in your username.” As for the security or privacy implications of this, you may draw your own conclusions, as my interest was primarily in how it works. I give Facebook the benefit of a doubt more often than a lot of savvy folks, but nothing here sticks out to me as risky or imprudent.

Twitalytic—which Gina released as an alpha this week—is a PHP application that combats the disappearing tweet problem by archiving your tweets, plus all replies to them and all mentions of your Twitter name, and along the way aggregates meaningful data about your relationships, all on your own server.

Of course I set it up as soon as I got a chance. I could have installed it on one of my home machines, but I decided to put it on my public web space, which happens to be hosted on the cheap by DreamHost (disclosure: affiliate link). Being alpha software and pretty untested, setting Twitalytic up on DreamHost didn’t go entirely smoothly, but I got it working eventually. Since I’m sure others are struggling with the same task, I wrote up the method I used to get it working:

How to install Twitalytic on DreamHost.

I posted the instructions on Twitalytic’s GitHub wiki because I want other people to be able to improve and correct them, so if you see any errors or potential clarifications or simplifications, please edit the article and improve it.

P.S. Gina enthusiastically thanked me for posting the tutorial, but it’s worth quoting what she wrote on the Twitalytic home page: “Do not run on a public, production server. You have been warned.” Nevertheless, if you’re as determined to set it up as I was (and perhaps as foolish), I hope my instructions are useful to you.

These articles are fun for me to write, so I’ll keep it up for the time being. In the Download Squad comments there were requests for instructions for LiveJournal and Iterasi. They both turned out to be easy enough, so read on for the instructions.

In each case, follow the same steps as in the previous tutorials. Head to the Google Reader Settings page, go to the Send To tab, and scroll to the bottom. Click on “Create a custom link” and in the form that appears enter the values below. When you’re done click on Save.

LiveJournal

URL

http://www.livejournal.com/update.bml?event=%3Ca%20href%3D%22${url}%22%3E${title}%3C%2Fa%3E&subject=${title}

Icon URL

http://www.livejournal.com/favicon.ico

Iterasi

URL

https://www.iterasi.net/Capture.aspx?v=1.0&u=${url}&t=${title}

Icon URL

https://www.iterasi.net/favicon.ico

Thoughts

The reason the LiveJournal one is pretty ugly is that the “event” parameter contains the actual text of the post it creates on LiveJournal—which, in our case, is an HTML link—and for it to work correctly we have to “URL encode” it before we put it in the URL. Unencoded it’s just this very boring bit of HTML:

<a href=”${url}”>${title}</a>

If you want you can replace that with any HTML or text you want as long as it’s encoded (except for the ${title} and ${url} parts, which must remain unencoded).

This one, as it turns out, is even easier than the one for Instapaper.

Update: Over at the official Evernote blog they’ve posted alternate instructions that clip the entire page, which you might find more useful.

How to add an Evernote “Send To” link to Google Reader

1. Go to the Google Reader Settings page. On the “Send To” tab, scroll to the bottom and click on “Create a custom link.”

2. In the “Name” field type “Evernote,” or whatever you want.

3. In the “URL” field paste the following:

   http://www.evernote.com/clip.action?url=${url}&title=${title}

   Make sure you get everything, starting with “http” and ending with “${title}”. Don’t change anything.

4. In the (optional) “Icon URL” field paste this:

   http://www.evernote.com/about/img/favicon.ico

5. When you’re done it should look like this:

   

   Click on “Save” and you’re done!

Now when you click on “Send To” on a Google Reader item a new page will load, instantly adding the item to Evernote and giving you options to choose a notebook and tags. (If you’re not logged into Evernote Web you’ll be prompted to login first.)

Already people are coming up with cool uses for this. Digital Inspiration, for example, shows you how to add a Send To link that’ll make a PDF document (via Lifehacker) out of the linked item.

My first thought, though, was to make a Send To link for Instapaper

Instapaper is a simple web app that lets you keep a “reading list” of articles on the web that you want to read but don’t have time for right away. There are already Greasemonkey scripts that tie Instapaper into Google Reader, but a Send To link will work in any browser and shouldn’t break if Google makes changes to Reader down the road.

Update: The day after I wrote this Google added a built-in Instapaper option to Reader. It works great, but a little differently: Whereas the instructions below will instantly add the feed item to Instapaper without any input from you, Google’s built-in method takes you to an Instapaper page where you can edit the Title and Summary of the item before saving it, requiring an additional click–unless you’re not logged in, in which case you must login first and then click the Send To button again. It has the benefit, however, of not making you give your Instapaper username or password to Google. You should choose whichever method suits you best.

So, on to the goods:

How to add a “Send To” link for Instapaper to Google Reader

1. Copy the following URL to your favorite text editor:
   

   https://www.instapaper.com/api/add?url=${url}&title=${title}&username=USERNAME&password=PASSWORD

   Replace the big “USERNAME” with your Instapaper username (or email address, if you use that to login on Instapaper). If you have a password, replace “PASSWORD” with it. If you don’t have a password, just delete everything after your username (“&password” and everything after it).

   Don’t change anything else.

2. Go to the “Send To” tab on the Google Reader Settings page. At the bottom, click on the “Create a custom link” button. A form will appear:

   

   In the “Name” field type “Instapaper” (or whatever you want). Copy the URL you edited from your text editor and paste it in the “URL” field. The “Icon URL” is optional, but use the URL above if you want it to show a pretty Instapaper “I” icon.

   Click on the “Save” button.

3. That’s it!

   Now when you click on “Send To” on a feed item you’ll see Instapaper in the list, and when you click on it your browser will make a request to the Instapaper API. You’ll see a new page load in your browser. If it says “201″ that means it worked and the item was added to your Instapaper reading list.

Troubleshooting

If you see a different number, there was an error. “403″ means there was a problem with your username or password. In that case, make sure that you’ve replaced “USERNAME” and “PASSWORD” in Step 1 with your Instapaper username and password, <strong>not</strong> your Google Reader username and password. Remember that if you don’t use a password when you log in to Instapaper you must remove the “PASSWORD” part of the URL.

A “400″ means there’s something else wrong with the URL. Make sure you copied the whole URL, starting with “http” and ending with “{title},” and that you’ve only changed the “USERNAME” and “PASSWORD” parts.

A “500″ error means something else is wrong and it’s probably not your fault. Try again later.

If you’re curious and technically-inclined you can learn more about the Instapaper API over here.

Update: Based on a suggestion over at Lifehacker I also put together a tutorial for adding an Evernote Send To link to Google Reader.

Two more after the jump…

You can see more of Todd’s work at the Adamson Studios web site and his daily photo blog Photernal, and you can find him on Twitter as @toddadamson.

The other day I bought a refurbished Dell Studio Hybrid, a cute little desktop computer called a “hybrid” because inside it has as much in common with a laptop as with a mini-tower. I’ve never bought a Dell before, but its nine-inch form factor and attractive chassis along with the refurbished price gave it a lot of appeal as a replacement for my hulking living room machine.

It has a lot of nice design touches,  most of which I saw in the many photos online, but there’s one that I didn’t notice until I started playing with it, unwisely turning it this way and that while it was running. Well, I won’t spoil it for you—check out the video above (there’s no audio).

Here’s how it works in a nutshell: When you first start Lose It! it asks your weight, age, height, gender, and your goal weight (mine is 190 pounds). Then it asks you how many pounds you’d like to lose per week, from one half to two (I picked 1½), and comes up with a daily calorie budget for you (mine started at 2,099). Then, when you eat or exercise, you punch in what you ate or what you did, and it subtracts or adds calories to your budget appropriately.

The heart of the Lose It! experience is the built-in food database, which includes some thousands of home-cooked, supermarket, and restaurant foods. It’s super-easy to use, but if Lose It! doesn’t live up to its eponymous promise for you, it’s the database that you’ll blame. It’s just not that comprehensive, and there are a lot of odd holes in it—grilled chicken breast is absent, for instance. Most of my tastes are as banal as that, and I find myself manually entering about half the foods I eat.

Despite that, Lose It! works for me. Partly because I don’t mind googling half my meals, but mostly, I think, because it brings accountability to my eating habits. Now I know that if I eat that second delicious cupcake I’m going to have to make a note of it, and it’s going to subtract from my budget and, if I’ve already eaten enough today, maybe push me into the red. Even if the database and budget math weren’t accurate (and I  believe they are), Lose It! would still be valuable to me just by making me push a button every time I put something in my mouth.

What you’re really wondering, though, is “Does it work?” When you stick to your budget, yeah, it does. I’ve lost around four pounds in three weeks. Just under my pound-and-a-half goal, and that’s without any exercise on top of my usual regime of nada. At right you can see my three-week weight chart.

You can see that for the last week my weight has gone up and down, trending pretty horizontally. Which, for the price of zero dollars, I’m completely happy with. I’m feeling healthier, I’m not gaining weight, and I just don’t feel like eating as much. Lose It! doesn’t even sport any advertisements or branding, which is great, but makes me wonder if its makers aren’t working on a for-pay follow-up. If they are, I’ll buy it.