Could this have been prevented? Did Salma do anything wrong? Did Apple? If the reports are true, the answers are yes, yes, and yes.

As MobileMe’s “Forgot Password?” feature is implemented, you need three things to reset the password to one of your choice and thereby get into an account:

1) The person in question’s MobileMe name/e-mail address (often easy to guess, since chances are good it’s some form of the person’s first and last names–and even if it isn’t, it’s by definition not secret);

2) The person’s birthday (a cakewalk to determine if the account holder is a famous movie star, and really not that difficult for civilians, too, especially in a day of social networks);

3) The answer to the person’s “Secret Question” (which with MobileMe can be any question of the account holder’s choice–you’re not limited to standard ones like your mother’s maiden name).

If you have these three pieces of information, you’re in. Unlike many online services, MobileMe doesn’t require verification via e-mail before letting you reset the password. That’s understandable, I guess, given that it’s possible that a MobileMe user’s only e-mail account is his or her MobileMe one; in such cases, you can’t receive e-mail verification if you can’t remember your password. But it opens up a gigantic security hole.

E-mail user names are easy to guess at; birthdays are easy to find out. The one piece of information that’s potentially impossible to guess is the secret question. But Salma apparently made the mistake of choosing a question and answer that anyone vaguely familiar with her career could guess–in fact, you might be able to guess the answer even if you didn’t know the question. But I’m not letting Apple completely off the hook–here’s the section of its MobileMe settings where you specify your secret question and answer:

Apple’s example of a “Secret Question” is by definition one that’s not secret in the least–unless you’re a hermit with a pet who you’ve never mentioned to another living soul. Even assuming that MobileMe users are smart enough not to use that question, it’s a lousy example to give them.

I don’t mean to bash Apple–or at least to bash it alone. There are other services with more or less identical security systems, and they’re all deeply flawed.

What’s a user to do?

1) It’s a good idea to check out the “Forgot Password?” features for services you use. Ones that send you an e-mail as part of the process are probably reasonable secure; ones that let you reset the password in the browser are risky.

2) Give some thought to making up an imaginary birthday you claim to have only when signing up for online accounts (assuming there are no legal repercussions to fibbing). If Salma had claimed she’d been born on March 19th, her MobileMe account would never have been compromised.

3) Don’t use secret questions with answers that aren’t truly secret. Again, lying about things like your mother’s maiden name or your high school mascot is worth considering. If you get to make up your own question, make it cryptic. Or even nonsensical–if your question is “What is my favorite ice cream flavor?” and the answer is “plaid,” nobody’s going to break in by guessing once or twice.

4) If you’re a movie star, never use the name of a person you’ve played as the answer to your secret question.

I hope that the publicity surrounding Salma’s misfortune causes Apple–and other proprietors of online services–to tighten up their security by a notch or two.

Part of that wipe took out my calendar and contacts–I knew I forgot to back something up, and that was it. Not to worry, though: I had them on my iPhone 3G, too. I could just merge them back on my first sync with my freshly-wiped and speedier MBP, right?

Not so fast.

I did not renew my service with MobileMe when it expired last December. Little did I know that once you sync once with the service, Apple all but owns your information.

This means that if you leave the service for whatever reason, your synced information is as good as gone if you don’t have it locally. It won’t sync with iTunes (I wondered why new appointments and contacts suddenly weren’t getting synced anymore), and there’s no way to go back to just syncing sans MobileMe. You’re stuck.

When I tried to disconnect the syncing, I found out the hard way that turning the sync off also wipes the services synced clean. Yep, even if you created the information before you even had MobileMe.

I thought I could get it back by going back to my old iPhone, signing up again for MobileMe (wasting $99), and waiting for it to sync up. Nope, didn’t work, even after I gave it 8 hours overnight to do it. The only way I could get over-the-air sync working again was to add something on the MobileMe side–which, you guessed it–wiped the iPhone clean, too.

Great. Now I’m spending my Saturday attempting to pick up the pieces of my contact list. Wasting what could be a nice day on the slopes to get appointments back in the calendar. A little peeved? You betcha.

Apple, this isn’t appropriate. You don’t own this information. I can see the e-mail service–but contacts and calendar information shouldn’t be held prisoner because I’ve decided to cancel MobileMe.

Is it wrong for me to think this way? Am I overreacting? I don’t think so. I do think if Microsoft did something like this with their service, they’d be run out of town with torches and pitchforks.

I plan to be at Mobile World Congress–which is the one best place in the world to learn about what’s new with mobile phones–and will let you know what I find out…

How’s it going so far? Not bad, but not entirely free of bumps. A few notes on the Web-based applications I’ve been using:

Blogging: Technologizer is based on the wonderful WordPress platform. I’ve gone through periods of writing blog posts in desktop tools such as Ecto, but lately I’ve just been writing directly into WordPress. No changes in my habits required here.

E-Mail: I’ve been tending to bop back and forth between Apple’s desktop Mail app and Gmail (into which I route both my personal and Technologizer mail) in recent months. For the duration of Operation Facebook, I’ll just skip the bopping and work in Gmail. It ain’t perfect, but it’s more than up to the task.

Calendar: Actually, when I want to check my schedule, I’m as likely to do it on my iPhone as on a computer. When I do use the computer, I’ve usually done so with Apple’s iCal. But I use MobileMe to sync the iPhone and iCal, and it also gives me a Web-based calendar service that looks and behaves much like iCal. I should be in good shape there.

Image processing: Here’s where things get tricky. I do most of my image wrangling for Technologizer in Photoshop–it’s probably the most purely desktop-centric work I do.

Yesterday, I needed to grab and edit an image of the logo for Google’s Android OS for a post I was working on. With Photoshop out of the picture, I decided to try Aviary, an impressive-looking suite of graphics tools that wasn’t available when I wrote a review of Web-based image editors for PC World a couple of months ago. Aviary is impressive–unlike most online image editors, it’s aimed at pros rather than casual shutterbugs, and comes closer to feeling like a plausible Photoshop substitute than any other Web image editor I’ve seen…counting Adobe’s own Photoshop Express.

I brought a copy of the Android logo into Aviary’s Phoenix image editor, cropped and resized it…and got an error message when I tried to export it so I could bring it into WordPress. Oops. Aviary still looks extremely neat, so I’m going to come back to it. But I had work to get done, so I hopped over to Picnik, the image editor I named as a Best Bet for my PCW review. Picnik doesn’t set out to replace Photoshop, but for what it tries to do, it’s one of the best-designed Web apps of any sort I’ve ever used. And I was able to get the Android logo into shape with it in a couple of minutes.

I was going to write in this post about the experience of dumping the big, powerful, expensive MacBook Pro for small, simple, and cheap Mini-Note, but that really deserves a post of its own. Which I’ll write soon. Stay tuned for that and more of Operation Foxbook as the experiment continues…

The latest example is today’s news that current Mobile Me users will get an extra sixty days of service, on top of the free month it extended to Mobile Me early adopters and .Mac veterans a month ago. It’s an appropriate, classy step, but I’m also struck by the honesty of the language that Apple used in announcing the extension:

“The transition from .Mac to MobileMe was rockier than we had hoped.  While we are making a lot of improvements, the MobileMe service is still not up to our standards. We are extending subscriptions 60-days free of charge to express appreciation for our members’ patience as we continue to improve the service.”

Admitting problems in the past tense is unusual enough in the tech biz; admitting them in the present tense, and implying that they’re ongoing in nature, is practically unheard of. I’m sure there are other examples; I just can’t think of any at the moment.

One nitpick: The MobileMe status blog is now three weeks out of date, and doesn’t mention this extension–at least not as of the time I’m blogging this.

Okay, two nitpicks: The Apple site still touts the wonders of MobileMe, which is a little odd given that it’s simultaneously describing it as not being worthy of Apple.

Okay, a meta-nitpick as well: Wouldn’t it have been cool if Apple had declared MobileMe to be in a retroactive free beta, and suspended charges altogether until the service was up to its own standards? You gotta think the goodwill such a move would generate would be more valuable than the cash generated by MobileMe subscriptions.

Of course, Apple’s handling of MobileMe will only be truly successful once the service is working to the satisfaction of folks who pay the company $70-$100 a year for it. If it’s still bumpy sixty days from now, wonder if Apple is prepared to do yet another extension?

Your thoughts?

But the one thing about Gmail product manager Todd Jackson’s post that kinda bothers me is this aside towards the end:

“We don’t usually post about problems like this on our blog, but we wanted to make an exception in this case since so many people were impacted.”

Jackson goes on to suggest that people who encounter Gmail problems check out Gmail’s online help and user group for the fastest updates; fair enough. But I hope that Google isn’t too cautious about using its many official blogs to discuss problems with its services and what it’s doing about them. A corporate blog that alerts users to cool new features can be useful; one that’s a comprehensive guide to the services it covers–warts and all–can be invaluable.

Thinking back to AOL’s famous string of humiliating outages in the mid-1990s, one of the things that got the company through them was CEO Steve Case’s letters to AOL users. They were proto-blog posts, prominently displayed on the AOL home page and pretty open about the service’s hiccups, of which there were many.

Today, even Apple is using blogs to deal with MobileMe’s ongoing issues–in a somewhat halting and stilted fashion, but at least it’s trying.

So please, Google (and every other Internet company I deal with): Err on the side of addressing the challenges you and your customers face on your blogs. Apologies are appreciated, but a generally up-front approach to explaining what happened, what you’re doing about it, and whether it might happen again is much more important than “I’m sorry.”

For a dozen years or so now, the Internet has been a mainstream communications medium, and its history has been pockmarked with examples of big-time services choking for extended periods–often a lot longer than today’s Gmail blip. The most famous examples of unplanned downtime have a lot in common: They usually last longer than anyone expected and get blamed on cryptic technical glitches. Almost always, angry consumers announce they’re done with the service in question; almost always, the service eventually recovers.

Oh, and one more thing: The biggest and most embarrassing failures all seem to happen during the summer months. Maybe technology, like human beings, just doesn’t work quite as hard when the weather’s hot and there are distractions like baseball games, picnics, and vacations to contemplate.

Now that Gmail’s back, it’s worth recapping a few other outages that made headlines when they happened–and since the ones that follow are in alphabetical order, they begin with maybe the most famous one of all (hint: it involved a company whose initials are A.O.L.)…

Who? America Online, the company that was synonymous with online services in the mid-1990s.
When? August 1996.
How long? 19 hours.
Why? AOL CEO Steve case blamed it on problems with the installation of “”high capacity switches within the local area network.“
Upshot? The service’s 6.3 million users received refunds for the downtime.
Saving grace? Steve Case’s artful and honest work as chief apologist made him even more famous as AOL’s public face.
Any other problems? AOL suffered multiple embarrassing outages in the era (here’s another one), then pretty much got over having ‘em–though a 5-hour e-mail meltdown in 2006 felt like old times all over again.

Who? eBay, then as now the world’s biggest auction site.
When? June 1998.
How long? Almost a day–reportedly the biggest outage in online history at the time.

Why? “[The] problem resulted from a failure in the software that was used to list items for sale and update bids. He insisted it was not a problem with the site being strained to capacity and said it was not clear why it had failed.” Matters were complicated further by the fact that eBay hadn’t quite finished implementing a backup system.
Upshot? eBay lost an estimated $3-$5 million in sales and was forced to offer refunds, extend auctions, and waive fees by way of apology to sellers whose auctions were affected.
Saving grace? Some eBay users who had bid early on items in auctions that were scheduled to end during the time the service turned out to be down got bargains.
Any other problems? This outage was one of several catastrophic ones that eBay suffered in 1998 and 1999.

Who? MobileMe, Apple’s brand-new service for synching information on iPhones, Macs, and PCs.
When? July 2008
How long? Several weeks of at least sporadic issues for some users.
Why? Apple’s MobileMe blog mentioned multiple technical gremlins, including “a lot more traffic to our servers than we anticipated,” a bug “that was preventing MobileMe IMAP mail folders from syncing correctly between the web app and Mac OS X Mail or Outlook,” and “a serious problem with one of our mail servers.”
Upshot? Apple extended all MobileMe accounts by a month; Steve Jobs said that the MobileMe launch wasn’t “up to Apple’s standards” in a widely-published internal memo and put a new Apple exec in charge of the service.
Saving grace? None to date, although it’s been a rare opportunity to see Apple eat crow.
Any other problems? As I write this, it appears that the worst of MobileMe’s woes may behind it, but grumbling continues; on June 29th, an Apple blog post promised an update later in the week, but none have been published.

Who? MSN Messenger, the instant-messaging service from the world’s largest software company.
When? July 2001.
How long? For some users, about a week.
Why? “[An] extremely rare set of circumstances occurred when one of our database servers had a disc controller fail.“
Upshot? Some unhappy users decamped to AIM, Yahoo Messenger, and other IM services.
Saving grace? The outage didn’t help people feel better about Microsoft’s scary HailStorm initiative for serving as a one-stop repository for all of consumers’ data and probably helped to kill it.
Any other problems? MSN Messenger also went down in 2003 and 2005.

So it’s nice to see the news that Apple is proactively giving everybody who signed up for its MobileMe service or was an existing .Mac user an extra thirty days of service by way of apology for the service’s erratic availability after its launch last week. Gizmodo has the text of an email in which the company admits the rollout was “a lot rockier than we had hoped” and had “lots of problems.” That’s serious crow-eating by any standard.

The company also said it’s going to stop referring to MobileMe’s data-synching as involving “push” for now, since it can currently take up to 15 minutes for e-mail and other info to travel from a Mac or PC to the Web or an iPhone.

(Incidentally, I have a MobileMe account and qualify for the extension, but haven’t received this e-mail yet; why, I’m not sure.)

MobileMe costs $99 a year, so the extra thirty days are worth around $8.25–not a huge whoop, but still nice.

I’m still playing around with MobileMe and forming a firm opinion–it’s a good idea for sure, and an ambitious one, but I wanna get a better sense of just how well it works and if the initial hiccups are over.