Faces in the Distorting Mirror: Revisiting Photo-based Social Authentication