Several weeks ago, Blogger added a security feature to Blogger commenting, to reduce comment spam.Note: Even if you don't have word verification turned on, anonymous commenters might be asked to enter some text. This helps protect your blog from abuse.
This change has not pleased everybody.I disabled "prove you're not a robot" for commenting. Why do my readers still have to solve a CAPTCHA, each time they comment?
This blog owner is not looking at the bigger picture. This new feature will benefit many blog owners - when Blogger is used, properly.
By adding a CAPTCHA, to the option to allow anonymous comments, we get several benefits.- People can allow anonymous comments, without allowing uncontrolled spammer activity.
- People can allow authenticated comments, and not require a CAPTCHA.
- The overall level of spam, currently being seen on some blogs which allow anonymous comments and require no CAPTCHA, will drop. This will allow Blogger Security engineers the chance to concentrate, more intently, on the remaining spam.
Instead of restricting the ability for people to comment on our blogs, this change actually increases the ability for people to comment - and decreases the spam.
People who are logged in to Blogger - and who are visible as logged in - won't even see the new CAPTCHA, even if they want to comment anonymously. Only people who are not logged in (or who are not seen as logged in), and who wish to comment without logging in, will be inconvenienced.
The biggest problem, with the new CAPTCHA form, is with people who are seeing the CAPTCHA even when logged in - because they are filtering "third party" cookies. Those people will have the choice of logging in again, or solving the CAPTCHA.
Anybody who is not logged in can avoid having to solve the CAPTCHA, even if one is presented, by logging in to Blogger. Since the standard Google "One account" login is used, people who do not have a Blogger account can setup one, on the fly, in a couple of minutes. This option is not obvious, from the commenting form - especially with the CAPTCHA displayed - but it is present.
Since the commenting form comes in 4 versions, depending upon template type and comment form placement, Blogger Engineering will need to make a coordinated effort, to improve the overall design of the comment form.
The various buttons and links, which allow the comments to be published using the many options, will have to be displayed better - to make it apparent to everybody that logging in to Blogger can avoid use of the CAPTCHA - even if the reader wishes to not identify, by commenting anonymously. And, other improvements are needed, also.
And once again, I will point out that a better user experience will be had by all who can properly maintain their computers, and not block "third party" cookies. Anybody, who is able to login to Blogger, should be able to comment anonymously, without inconvenience of the CAPTCHA.
Some solutions in Blogger require our action - not just action by Blogger Engineering.
>> Top
Some time ago, I discovered an odd type of comment spam, which I termed "Nice Blog" spam.Nice blog. I will keep visiting this blog very often.
This spam, from what I can tell, has been published by the millions, in various blog comments.
It's likely that this particular spam is being published as a very imaginative form of email address mining. The phrasing started out almost identical to the above example - but recently became rather imaginatively worded.
All that the spammer has to do is publish a "nice blog" spam comment, against a typical Blogger blog post, and select the option to "Send me replies".
Any comments published later against that post, and including the commenters actual email address, would be delivered directly to the spammers inbox. Knowing the email address - and the blog URL (how many comments do not include a link to a blog?) - the hacker would go straight to work.
Later, we would see forum reports.I can't control my blog, any more - and somebody has filled it with spam!
This was a direct result of the former blog owner, having left a comment on somebody else's blog.
By eliminating our email addresses from our comments, Google is helping to protect our accounts and blogs, while letting us continue to comment on each others blogs - and to discourage one type of unnecessary spam from our blogs.
>> Top
Not all blog owners understand the need for people to post anonymous comments, against our blog posts. Periodically, in Blogger Help Forum: How Do I?, we see the naivete expressed by some.How do I find out who is posting anonymous comments to my blog?
These people do not understand the need for anonymous commenting.
You, as a blog owner, have the ability to select the level of authentication, to be required of anybody preparing to post a comment to your blog. For "Who Can Comment?", we find the selection list- Anyone - includes Anonymous Users
- Registered Users - includes OpenID
- Users with Google Accounts
- Only members of this blog
People who wish to comment anonymously, yet provide a "Name" / "URL" to link back to their Blogger profile, or their blog / website, may do this at their discretion. Anybody doing this provides no guarantee of being genuine, however.
If you allow "anonymous users" to comment, then people who wish to comment anonymously need to be assured that their privacy will be respected. You can gather demographic data about your blogs visitors - and you may infer specific details about individual commenters - but the relevance of that policy will be limited by the precautions exercised by your commenters.
>> Top
Blogger supports anonymity - both in our ability to maintain and to own a blog anonymously, and our ability to comment on blogs anonymously. But this anonymity comes with a price.I need to contact the owner of "xxxxxxx.blogspot.com", but there is no contact information and the blog is private.
orHow do I find out who left an anonymous comment on my blog?
orI can't access my blog - I forgot the password and the email address doesn't exist any more.
orI deleted my account, and they won't give it back to me!
All of these are queries by bloggers who do not understand the price of anonymity.
If Blogger is going to preserve our anonymity as blog owners, and as commenters (on blogs where anonymous comments are allowed), they cannot give out any information, to anybody, that might disclose our identity.
Blogger / Google must protect anonymity diligently, to be trusted.
If Blogger / Google starts disclosing identity information, to people who ask casually, nobody will be able to trust our - or their - intentions.
If you let people comment anonymously on your blog, people will comment with the expectation that you won't be requiring any personal information, other than demographic information that's obtained through a visitor log. If you don't like anonymous comments, you either disable anonymous comments - or you moderate comments, and discard what you don't like.
You - and only you - must maintain your anonymous, multiple identities.
If you setup a new Blogger account, and then create a new blog, and you include no personal details in either the account or the blog, you will wind up with a Blogger account that cannot be recovered, if you ever forget the account name / password - or if the account is ever locked for "suspicious" / "unusual" activity.
Don't demand that Blogger break someone's anonymity, without legal need.
If someone publishes a blog without a Profile gadget, or publishes a blog privately, without including contact information somewhere, don't expect to casually write to Blogger and demand contact information. And don't try claiming to own the blog in question, and that you forgot the password - or that you cannot remember the many different email addresses that you may have used.
Blogger cannot disclose the identity - including the email address - of the owner, if anonymity is to be preserved. This includes if your blog is deleted, and you don't know the owner account.
You may have to find out owner identity, on your own.
It's possible that you can identify a contact, on your own. If you require contact information provided by Google, you'll need legal assistance, and a court order.
Every day or so, we see reported from concerned bloggers, about unknown content in their blogs.Where did those ads come from? I didn't add them!
orHow do I keep this other blogger from posting porn links in my blog?
As we add content to our blogs, and make them fun, interesting, and shiny, to attract readers, we risk adding undesirable content. This is a constant problem.
The bad guys are out there - and the more fun, interesting, and shiny your blog is, the more it's likely to have readership, reputation, and value.
The more readership, reputation, and value that your blog has, the more attractive it is to the bad guys. And the bad guys have various ways to attack a given blog.
- Malicious Comments
- Malicious Posts
- Malicious Accessories
- Malicious Blog Members
- BlogList / Feed Gadgets
Malicious Comments
One of the easiest way to add third party content to your blog is from allowing comments.
Comments are contributed by people who, at best, you simply do not know. Any content from someone who you do not know can always be malicious, or obnoxious in some way.
Some blog owners will try to identify and block individual commentors. I will continue to insist that anybody who you should fear will not be bothered greatly by anything that you can do here.
You absolutely must moderate comments, or risk having a blog known for hosting malicious links - or worse.
Malicious Posts
Besides comments, posts are a constant concern. If you have a team blog, you have to be able to trust the other members in the blog.
Post moderation, using post editor to publish, isn't an option. Anybody who you make an author can publish what they feel like publishing. You can only moderate posts after they are published, when using post editor.
An alternative to using post editor to publish is Mail-to-Blogger, where contributions are emailed to the blog. If Mail-to-Blogger is setup to publish straight to the blog, and the bad guys figure out your MTB account and password, you'll have malicious content a plenty.
You can moderate before publishing, using Mail-to-Blogger.
Malicious Accessories
Any time that you install third party accessories of any type, you are placing your blog at risk.
Don't be overly paranoid - you have to make your blog interesting to your readers. But do keep the risks in mind.
This is similar to layered security for your computer, which is a related concern here.
Malicious Blog Members
Sometimes, possibly having unwisely installed a third party accessory, the install process may have enabled the addition of an unknown member to the blog. The unwanted content may be added by the attacker, using this unknown blog member.
If none of the above advice offers you an explanation for the existence of unwanted content, check your blog member list.
BlogList / Feed Gadgets
Occasionally, we may Follow a blog where the owner will later decide to try to get more traffic to the blog, and will redirect the blog feed to a cloud of random blogs. If you are Following such a blog, or have such a blog in your BlogList or Feed gadget, you'll see your BlogList or Feed gadget show odd content - and frequent spam.
