Long ago, Blogger Support used to provide personalised account recovery service, to blog owners who had forgotten their account names and passwords - and give "hints" in open forum discussion, reminiscent of the popular TV game show, Wheel Of Fortune.
But reality intervened - and now, everybody who wants to recover access to a Blogger account / blog must use one of the automated account / blog access recovery tools- ignoring however defective they may appear to be.
We have seen several sad stories, played out in Blogger Help Forum: Get Help with an Issue.
Round #1
An unhappy "blog owner" would request assistance. I forgot the password. Can somebody help me recover access?
Blogger Support would email recovery instructions to "whatever @ gmail . com", and advise the "blog owner" I emailed your reset instructions to "w****** @ g**** . com".
Sometimes they would get the reply That does not help me. Can I buy a vowel?
Blogger Support, always optimistic, would give it another go.I emailed your reset instructions to "w***e*** @ g**** . com".
thenI emailed your reset instructions to "w*a*e*** @ g**** . com".
finallyI emailed your reset instructions to "w*a*e**r @ g**** . com".
Finally, the successful "blog owner" would reply Thank you so much! I am so happyyyyyyyy!!!
But the story did not always end there.
Round #2
The next month somebody would report My blog disappeared from my dashboard while I was in the hospital, in a coma. I now want to tell everybody how I am doing - but my blog is now full of spam, and nobody can read it!! Whatever can the problem be?
And the blog mentioned in Round #2 turned out to be the same as in Round #1.
Round #3
The final verdict would be that Blogger Support, while playing "Wheel of Fortune" in Round #1, had been playing with a hacker, who was then able to steal somebody else's blog.
Bonus Round
After that happened a couple times. Blogger developed the recovery tools, and wrote the final FAQ. And, stopped providing real time, personalised advice.
And that is that. You cannot prove that you are the owner of the blog, because you cannot communicate directly with Blogger Support. You have to use the tools provided - and / or search each email account, persistently.
Blogger Support will not play "Wheel of Fortune" any more. Everybody is urged to never reveal their email address, to the world.
In some cases, the blogs would be deleted, as new spam hosts - but ownership is seldom recoverable. Bankrupt
Your best solution, now, is to start a new blog - then combine the two blogs, in a blog cluster.
Every day we see the complaints, of the hundreds.Your instructions, for recovering access to my Blogger account, don't work!
And alternately, we see the anguish.I can't login to my Blogger account, because my account is locked!!
And the final complaint, which is the most heartbreaking.I can login, but my blog is not on my dashboard - and someone has filled my blog, with spam!!!
These are all reports about the same problem, in alternate universes.
Any time Blogger Engineering changes their account / blog recovery options, and cuts down on the numbers of one of the three, the other two will surely increase in number - because all three are symptoms of the same problem. People simply refuse to remember their account names and passwords.
There is one solution, which would be 100% effective, and drive the numbers of each of the hundreds, to zero.Everybody, without exception, would simply remember their account name and password.
Were that to happen, Blogger Security could remove all "backdoor" accesses and recovery tools, and blog thieves would have to go back to Barista College, or Hamburger University. There would be no more stealing control of peoples accounts or blogs - save maybe by watching somebody in public, as they login.
The recovery instructions do work, for people who make some effort.
The recovery instructions do not work, because you, the blog owner, simply don't make enough effort to remember / retain control of your accounts, or to protect your accounts. And in some cases, you simply have protected your identity, to make you completely anonymous - and can't identify yourself, because you are anonymous.
Remember your login details, and be one of the millions who work on their blogs.
If you remember your account name and password - and do not ever let your account name and password be known in public - you will never have to worry about account / blog recovery. You would then be one of the millions who do not care about account / blog recovery, because they never need to use the recovery tools.
Be prepared to re authenticate, when you travel!
And if you travel, be prepared! Setup Google 2-Step Verification before you step out the door. And whether you travel, or stay in the same place, use your account, and publish your blog, regularly.
Millions don't worry. Become one of the millions. Reduce the numbers of the hundreds.
If you're learning this concept too late - as many are, periodically - start a new blog, and combine the old and new blogs, in a blog cluster.
Blog owners continue to forget the account name and / or password of their Blogger accounts, then demand alternate recovery options.
Every week, we see the reports in Blogger Help Forum: Get Help with an Issue, claiming that changing their email - or getting a new phone - caused somebody to unfairly lose access to her / his blog. Too many blog owners refuse to understand that the email address and phone number are simply backdoor accesses to their Blogger accounts.
When given advice to use Blogger: Forgot your username or password?, or Blogger Help: Having trouble signing in or viewing your blog?, we frequently see demurrer.Neither tool helps me. Can I please contact a real person?
The implication, when demanding human real time contact, is that the blog owner (or would be blog thief) can provide secret details - which when supplied, will convince a real Google security employee that the Blogger account / blog is the legal property of the complainant.
Secret details, which are jointly effective for Blogger / Google and the would be blog owner, are quite limited.
Account / blog recovery details have standards, to be useful.
Any account / blog recovery has to be based upon details which have three requirements.
- The would be owner knows, and can use.
- Blogger / Google can verify, within their own databases.
- No third person can discover, using enough search time (Google or competitor) - or manufacture, using PhotoShop or a similar product.
Any details, which do not fulfill all 3 requirements, are either useless or unsafe. If unwisely accepted by Blogger / Google, they simply allow theft of someone else's properly secured Blogger account and blogs.
Verification can only use Blogger / Google maintained details.
Verification has to be based on Blogger / Google databases. Blogger cannot accept FaceBoook, Twitter, or WordPress personal pages or profiles, as proof of identity or ownership.
Blogger has a responsibility to active blog owners, to not permit theft.
Many complainants claim that Blogger is being unfair, in denying them access to their blogs. They overlook the fact that unwisely accepting publicly known or unverifiable details, as proof of blog ownership / identity, would be unfair to the millions of blog owners, who remember their login details - and are actively maintaining and publishing their blogs.
The purpose of account recovery is not to simply allow every blog owner access to their blogs, even if they casually neglected to remember required identification tokens (account name, email address, password, etc.). The purpose is to allow as many blog owners as possible access to their blogs - while preventing malicious blog theft by hackers able to misuse the provided recovery tools.
Active blog owners want their blogs to remain theirs.
People who carefully maintain access to their accounts and blogs do so, based on the presumption that Blogger / Google will not unwisely give someone else access. These people appreciate the Blogger promise that our blogs will remain ours, forever - as long as we exercise common sense and courtesy.
The many blog owners, who maintain both front door and back door access - and actively maintain and publish their blogs - do not really care about the few who need "their" long dormant blogs recovered - or who want to delete "their" blogs, so they can move their activity to FaceBook or WordPress. They appreciate that Blogger will not give up login details, without observing appropriate caution.
We see the pain, in Blogger Help Forum: Something Is Broken, of blog owners who do not understand the need for keeping the name of their Blogger account a secret.I forgot the email address that I was using. Why can't Blogger just tell me the address??
and some askHow did this unknown person "xxxxx xxxxx" get control of my blog?
Years ago, the local police would have to convince home ownersPlease, stop leaving a spare key under a rock, near the door!
Both many blog owners (today) - like some home owners (years ago) - had the same basic problem - naivete.
Like the home owners of years ago, who kept a spare key under a rock near the front door, for emergencies, blog owners will use tricks to remember their password.
Don't - please don't - use a guessable password!
One favourite technique, for remembering the password, is so obvious.
Pick a password based upon something that you can remember.
For a blog owner who is married, the answer is obvious.
What is my spouse's name?
and there's your password. If you forget that, you have worse problems, that cannot be addressed here.
If the name of one's spouse was a secret, using the name would not be a problem. But knowing that many blogs either contain the name (and picture, maybe) of the whole family - or lead to a Profile page or website (FaceBook, Instagram, Twitter, ...) with similarly useful information - how secret is the password going to be?
Hackers love blogs with guessable passwords.
Knowing both the Blogger account name (email address) that owns any blog of interest, and the URL of the blog, any hacker has a simple enough task.
- Scrape blog content, into a text analyzer.
- Extract a few hundred details (spouse's name, and others) from the blog content, as analysed.
- Run the known details through a password generation program.
- Now, the hacker has a database, containing "10,000 good possible passwords", specifically relevant to this blog.
- Go to "www.blogger.com", plug in the account name, and try out the 10,000 passwords, one by one.
- That's a simple brute force password attack.
- Sit back, and watch any botnet, controlled by the hacker, go to work.
- Given enough time, the hacker very likely gets access to the Blogger account, and to the blogs owned by the account.
Steps 1 - 8, for any experienced hacker, will be summed into one step.Plug in the URL of the blog.
Everything needed is just more coding - and a nice robust botnet or two.
The hacker, of course, will be targeting thousands of different blogs, simultaneously. So what if he (she) fails to find what details she (he) needs, to steal your blog? He'll (she'll) gladly settle for another - while the botnet works on yours.
Besides using a "strong" password (which carries it's own risks such as forgetting the password - and now we're here, again), the best way to prevent a brute force attack is by preventing step 5.
Keep the account name / email address a secret.
Additionally, if you have a blog and a business - or otherwise exchange email with strangers, separate your Blogger / Google account and your email account. Use two separate email addresses, for Blogger and email.
Learn to appreciate efforts made, by Google, keeping your account and blogs safe.
If you need to recover access to your Blogger account, don't expect to use the Blogger "Forgot?" wizard, plug in your blog URL, and get a reply
Email was sent to your address xxxxxxx@yyyyy.zzz
And, if you post in the forum.
Please email me advice, to "xxxxxxx@yyyyy.zzz"!
expect to get a stern warning
Please, do not post Blogger account names, or email addresses, in the forum.
People objecting to the recent Blogger policy of masking email addresses, in Blogger commenting and similar services, as "no-reply @ blogger . com", may also need to consider this very real issue. Possibly, even use Google+, instead of Blogger commenting, for networking with ones peers.
Google tries to identify brute force attacks, and takes action when possible.
And, if your Blogger / GMail / Google account is disabled - and you get a mysterious notice about
Suspicious / Unusual activity on your account
this could well be the other side of a brute force attack against your account, intercepted by Google.
Don't be offended by the various precautions.
If you find the precautions and problems to be unacceptable, consider using Google 2-step verification, to protect your account against brute force hacking.
This is not fiction here - it's all very real.
None of this is fiction or paranoia - it's based on some very real, recent events, and even involves a recent National Scandal - and leads to some very real conundrums.
Similarly, we have a very distasteful answer, to a seemingly worthy need. And another apparently "ceremonial" but necessary answer, to somebody in need of understanding and support, that can't be provided.
You have to make the effort, to maintain and protect your blog.
You will get no sympathy, when you complain how unsupportive Blogger is.
You have to make some effort - and remember some basic information - if you are going to maintain a Blogger blog. And, encourage your friends to keep their accounts and blogs safe.
A frequently seen sign of confusion in Blogger Help Forum: How Do I? is the questionHow soon after deletion can I reuse a blog?
And the answer is two part.Immediately, if you can just undelete it using the same account. Never, if you are trying to transfer the blog.
Occasionally the response to that involves a complication.But I deleted the account, to make sure that the blog gets freed up.
And now, the blogger gets no choice.You have to reactivate the account, because the URL is locked to that account.
Now, the blogger has a four fold task ahead of him.- If you just recreated the Google account, by creating a new account with the same email address, you have to delete the account just created.
- Re activate the original Google account, using Google Accounts: Contacting Support - I can't access my account. Select "No" for "Did this work?", and fill out the form that you see there.
- Alternately, re activate the earlier deleted Google account, using Google Accounts: Google Accounts: Forgot your password?. Enter your email address, then fill out the form that you see next.
- Re activate the blog, if necessary, by un deleting it.
- Finally, what he should have done in the first place.
And next time, plan the change.
