Blog Security Review Is Not Instantaneous

Blog owners do not always understand the reasons behind the mysterious blog security check (following "suspicious" / "unusual" activity account lock).

We see periodic complaints about deleted blogs and locked accounts - and the inconvenience involved, in Blogger Help Forum: Get Help with an Issue.

I get the security and all - but I don't get how a blog is just deleted.

This blog owner, like so many, does not understand how Blogger is trying to keep our blogs under our control - even after detection of "suspicious" / "unusual" activity.

Blog security check, if immediate and instantaneous, would not be noticed.

Blog security check is an art - not a science - and it takes time.

If blogs could be checked for hacking interference without delay, most owners would not complain. Unfortunately, examining blogs for hacking interference requires intense study - and most security experts do not work on weekends.

One unfortunate issue, about all of this, is that not all "suspicious" / "unusual" activity is malicious. Some of it is a simple result of people unable to use account / blog recovery - being innocently told to try every account name and password that can be remembered.

Owner delay, in requesting account unlock, contributes to security check delay.

In some cases, the locked account / deleted blogs may not be immediately discovered by the owner - and this may lengthen the security check process.

Not all blog owners publish - or even read - their blogs regularly. Nor do they accept the need to intentionally keep their account and blogs under their control.

Some owners are very casual about blog security - until a blog is successfully stolen.

---

Some #Blogger blog owners are not terribly impressed by the need to keep their blogs under their control, until a blog is stolen. The measures taken by Blogger / Google Security staff are considered mere annoyances.

If You Travel, Be Prepared To Prove Identity

We're seeing reports from people who claim to be traveling, and who can't login and access their blogs.

Google appears to now authenticate us using current location, as well as account name / password. We see occasional reports, in Blogger Help Forum: Get Help with an Issue, about new security procedures.

I am traveling, and I need to access my Blogger account from another country. I know my account name and password - and I logged in successfully. But after logging in, I am still being asked to prove my identity!!

This blog owner is finding a problem, with Google taking extra measures to protect our accounts and blogs.

Google is trying to protect us, from people who access the Internet from different countries - and who try to access our Google accounts, and steal control of our blogs.

Somebody in a foreign land, accessing your account, may not be you.

If you normally access the Internet from your home, and you travel to another location and try to login to Blogger / Google, you may be asked for additional details, to prove that you are the legal owner of your Blogger account. You may feel like you are being treated discourteously, when this happens.

In reality, Blogger is simply trying to keep your blogs under your control, by preventing people other than you from stealing your Blogger account, blogs, and email account - and possibly, your friends Blogger account, blogs, and email account.

When you travel, you spend time preparing for the trip.

When you prepare to travel to a distant country, you are responsible for getting your travel documents (passport), permissions (visas), maybe make health preparation (update immunisations, get extra medications) - and learn a minimum amount of the local language, before you go.

Maybe you should also spend some time getting your Blogger / Google account in order (update any backup details, such as backup email address and phone number). Even, plan an account recovery, from time to time.

This is an excellent time to try 2-Step Verification.

You might even consider setting up Google 2-Step Verification - and generating a set of one time backup authentication codes.

If you don't prepare your account for travel, you may have to wait until you get home, to post to your blog. You may even be asked for proof of identity, when you get home, too.

Use Common Sense, And Protect Your Blog

We see various questions about getting advice and non standard accessories / code, from blogs and websites advertised outside Blogger / Google control - generally in Blogger Help Forum: Get Help with an Issue.

Why can't I see my blog? Every time I click on "View blog", I get a face full of ads!

and

Where can I get accessories, gadgets, and templates for my blog??

and

How do I know what accessories, gadgets, and templates are safe, for my blog?

and

Why did Blogger lock my blog, as a malware host?

All of these folks are discussing the same issue - blog content security. Some are asking properly, before they cause their problems - but others are not.

We have several known bad actors, right now - who have been putting out various blog accessories which, initially, work fine.

After thousands of victims have installed some accessories on their blogs, the owners and readers observe that the blogs are suddenly redirecting to advertising pages, or throwing popup ads on top of blog content. The latency period, for some blogs which are the first to install a new hacker provided gadget, may be as long as 6 months to a year.

By the time any malicious gadgets are discovered, identified, and removed, the victims have to deal with unhappy readers, who don't enjoy seeing a screen full of ads, instead of their favourite blog to read.

Search engine reputation is also affected by this problem. In some cases, the malicious gadgets may be detected by Blogger - and the host blog (ie, your blog) is locked, as a suspected malware host. Even if Blogger does not detect a problem, services outside Blogger will trash your blog.

Thoughtful blog owners will ask how they can get good, reliable, and safe blog accessories. I would start, by ranking the possibilities.

1. Blogger "Add a Gadget", with gadgets labeled "By Blogger".
2. Websites provided by well known Internet services.
3. Blogger "Add a Gadget", with gadgets not labeled "By Blogger".
4. Non Blogger websites provided by developers.
5. Non Blogger websites provided by hackers and spammers.

1. Blogger "Add a Gadget", and gadgets labeled "By Blogger".

The most reliable and safe gadgets will always be found in the "Add a Gadget" library, and be labeled "By Blogger". You have to trust Blogger, if you are going to use their publishing platform in general.

The optional gadget library, and gadgets "By Blogger", is just as safe as the dashboard, and components referenced by the dashboard.

2. Websites maintained by well known Internet services.

Most well known Internet services and social networking platforms will provide gadgets that are designed for Blogger. The best gadgets will be labeled "For Blogger", and be written in Blogger compatible XML. Some general purpose gadgets, written in HTML / JavaScript, will also be suitable.

Almost any gadget in this category, if written by the staff of the service in question, will be free from malicious intent. Both FaceBook, and Twitter, for instance, provide gadget libraries. Because these gadgets were not written by Blogger staff, they will not be as reliable as Category #1.

3. Blogger "Add a Gadget", and gadgets not labeled "By Blogger".

Many gadgets provided in "Add a Gadget" will be provided by third party developers. Hopefully, Blogger / Google exercises some quality control, over gadgets distributed through their library.

That said, the first mass hacking of Blogger blogs, of 2009 - 2010, came through gadgets that were distributed from the "Add a Gadget" libraries. One such gadget was discovered, just last week.

Not all third party accessories are provided with malicious intent. Unfortunately, even if not provided maliciously, some accessories may be unreliable because of periodic changes by Blogger.

4. Non Blogger websites provided by developers.

After the unforgettable blog hijacks of 2009 / 2010, then 2010 / 2011, Blogger / Google Security got aggressive with the problems of malicious gadgets being served from their libraries. Most recent hacking attacks have been distributed from websites outside the control of Blogger / Google.

Some non Google websites are provided by third party developers, who write code almost as reliable as Blogger staff. However, if the choice for my blog was between gadgets in Categories #3 and #4, and be of equal functionality and suitability, I would choose #3 over #4 - and I would seriously recommend the same, if asked.

In some cases, legitimate third party developers have provided accessories that require access to their code libraries. The developers have gone out of business, and have cancelled the domains where the code libraries were served. The abandoned domains have been bought by spammers, as investments - based on serving ads to accumulated incoming traffic, from people surfing to the blogs and websites which have the accessories installed.

In some cases, the domains were actually abandoned by the developers. In other cases, the developers were spammers, who sold their domains for a good profit, to other spammers.

We, the blog owners, cannot really tell which case is involved, when our blogs start redirecting to pages of spam - or even malicious domains, serving malware to our readers. We do need to protect our readers, though.

5. Non Blogger websites provided by hackers and spammers.

Some websites outside the control of Blogger / Google should not be trusted. I would seriously suggest without hesitating, that you stay away from websites like "SEOYourBlog.com", "MakeMunyFromHome.info", and such.

Any blog or website, with clever initials in the name, should be considered, with great caution. Although "SEO" was originally a serious concept, most websites with "SEO" in the name will not have your best interests in mind. Likewise "GPT, "PTC", "PTS" will do you no good.

If and when you add gadgets, always add them using a new HTML / JavaScript gadget. Gadgets added using "Add a Gadget" can be easily removed, if they go bad. Gadgets added using "Edit HTML" must be removed using "Edit HTML" - and some gadgets will be extremely challenging to diagnose and remove.

Security begins with you.

The Account / Blog Recovery Instructions Don't Work!

Every day we see the complaints, of the hundreds.

Your instructions, for recovering access to my Blogger account, don't work!

And alternately, we see the anguish.

I can't login to my Blogger account, because my account is locked!!

And the final complaint, which is the most heartbreaking.

I can login, but my blog is not on my dashboard - and someone has filled my blog, with spam!!!

These are all reports about the same problem, in alternate universes.

Any time Blogger Engineering changes their account / blog recovery options, and cuts down on the numbers of one of the three, the other two will surely increase in number - because all three are symptoms of the same problem. People simply refuse to remember their account names and passwords.

There is one solution, which would be 100% effective, and drive the numbers of each of the hundreds, to zero.

Everybody, without exception, would simply remember their account name and password.

Were that to happen, Blogger Security could remove all "backdoor" accesses and recovery tools, and blog thieves would have to go back to Barista College, or Hamburger University. There would be no more stealing control of peoples accounts or blogs - save maybe by watching somebody in public, as they login.

The recovery instructions do work, for people who make some effort.

The recovery instructions do not work, because you, the blog owner, simply don't make enough effort to remember / retain control of your accounts, or to protect your accounts. And in some cases, you simply have protected your identity, to make you completely anonymous - and can't identify yourself, because you are anonymous.

Remember your login details, and be one of the millions who work on their blogs.

If you remember your account name and password - and do not ever let your account name and password be known in public - you will never have to worry about account / blog recovery. You would then be one of the millions who do not care about account / blog recovery, because they never need to use the recovery tools.

Be prepared to re authenticate, when you travel!

And if you travel, be prepared! Setup Google 2-Step Verification before you step out the door. And whether you travel, or stay in the same place, use your account, and publish your blog, regularly.

Millions don't worry. Become one of the millions. Reduce the numbers of the hundreds.

If you're learning this concept too late - as many are, periodically - start a new blog, and combine the old and new blogs, in a blog cluster.

Your Right To Be Forgotten Does Not Supersede My Right To Retain Ownership Of My Blog

Thanks to a recent decision by the European Courts, many people are claiming the right to delete their blogs, and to have the search engines stop indexing their blogs.

Some people believe that this newly defined right entitles them to recover control of their blogs, published long ago, with access (account name and password) long forgotten. A few such people even have blogs owned by "legacy" Blogger accounts, never converted to Blogger / Google accounts.

Nobody has the right to unilaterally take control of a blog that may belong to somebody else. If you cannot prove yourself to be the owner of a given blog, Blogger Support should not provide to you control of that blog. Whether you want to delete a blog, or to change the content, you have to prove ownership of the blog.

So called "legacy" blogs are a concern, because even Blogger Support cannot authoritatively identify all "legacy" accounts. All that they can say is

If your blog was created before 2007, you may have a "legacy" Blogger account.

More properly, since some blogs were converted transparently (without realisation of the owner), they should say

If your blog was created before 2007, and never converted, you may have a "legacy" Blogger account.

The "legacy" account conversion took many years - and everybody was given many months of warning, to get their accounts converted. This was not an overnight process.

All that you can do is to try to convert your Blogger account, and see if you get control of your long forgotten blog. Even if converted, though, you have to be able to prove ownership of the account, once it's been converted - just as you have to prove ownership of any Blogger account.

Too many people try to steal ownership of someone else's blog, by claiming to own the blog - but conveniently forgot the account name or password.

Since there are more people working on their blogs (maybe not today, but sometime in the past), than are trying to recover control, people trying to recover control (or to steal someone else's blog), are going to get less support.

The term "actively working on their blog" implies no specific activity level. A blog, published once, 10 years ago, is just as valid as one published once daily for 10 years.

Blogger blog owners are entitled to the same courtesy and security - as long as each blog owner acts responsibly, and remembers the account name and password of an owning Blogger account. Similarly, blog owners are entitled to Blogger not providing clues, to blog thieves, that could assist in blog theft.

If Blogger / Google does not agree with your claim, and if you believe in the right to be forgotten, you hire a lawyer, and get a court order. Let the courts decide your special rights.

>> Top

Stolen Blogs Can Not, Generally, Be Returned

Whether you give up your blog willingly, have your blog stolen from you, or accidentally enable your blog to be stolen - once your blog is in someone else's control, Blogger cannot, legally, help you.

We see the naivete, periodically, in Blogger Help Forum: Something Is Broken.

I made my friend an administrator of my blog, and he changed me to an author. Can Blogger restore my ownership?

And the short answer, too frequently given, is denial.

No, Blogger cannot help you.

Blogs stolen, supposedly from their rightful owner, can generally not be returned by Blogger.

There are various ways to lose control of a blog.

• Some will, intentionally, transfer control - then change their mind.
• Others will naively make a friend a co-administrator - and have the friend take control of the blog.
• Still others may enable the blog to be stolen by a hacker.

In any case, once control passes to another person, it's unlikely that Blogger can, unilaterally, restore ownership.

Blog thieves are very persuasive - and masquerade as theft victims.

One problem here is that too many would be blog thieves start their tales with just these claims. Long ago, Blogger Support would, obediently, "restore" ownership, when requested - and we would later see the angry forum report.

How did this other person get control of my blog?

Blogger Support would research the second "theft" report - and realise, too late, that they had previously enabled the theft.

Blog owners enable some thefts, with security mistakes and requests.

Also, if you neglect to remember your account name or password, please don't just setup a new account, then suggest that Blogger transfer control of the blog, to the new account. This suggestion, also, has been used to make Blogger an unwitting accomplice in too many thefts.

Blog owners must assume some responsibility for problems.

The bottom line here is that you have to accept full responsibility, for retaining control of your Blogger account and blogs.

Even if your friends account is hacked, then used to attack yours, don't expect assistance from Blogger / Google. And please understand that blog security review won't happen, immediately.

Help Me! I Can't Access My Blogger Account!

Every week, we see the anguished cry of blog owners, who don't have access to maintain, or publish to, their blogs.

Help me! My email address changed last month, I dropped my phone into the sink, and now I can't sign in to my blog!

If you look at the fine print, you see the full story.

Ask enough questions, and the details will come forth.

Help Me! I never bothered to remember my password - I used the Forgot Password wizard to reset my password every time I wanted to sign in to my Blogger account. My email address changed last month, my phone number changed last week, I can't get the email from the Forgot Password wizard, or the new Blogger Account / Blog Recovery wizard - and now I can't sign in to my blog!

As I have repeatedly advised folks, and previously pointed out in 2010, Blogger lets us maintain our blogs anonymously, and promises anonymous access and ownership for eternity. There is no magic token attached to our blogs, that let us conveniently email Blogger and ask for a second (or a third) back door access to our accounts.

If you can't access your Blogger account, you can't maintain your blog. Use the Forgot Password wizard, when you have access to the email account - or the new Blogger Account / Blog Recovery wizard.

And learn how to use the Google "One account" login wizard, properly.

Blogger wants to protect us, and our blogs, from attacks from people who claim to be us, but are not. Help them to protect our accounts, and our blogs - don't require that they gratuitously allow you access to your blog when you forget the password, and have no second - or third - back door access to reset the password.

How To Not Get Content For Your Blog

One of the oddest displays of naivete we see, from some blog owners, asking in Blogger Help Forum: How Do I?, would be

How do I let anybody post to my blog?

These owners have no idea how popular they would be, with spammers, were this to happen.

If you have a blog, and you want to let up to 99 of your closest friends publish their thoughts to your blog, you can setup a team blog, and have fun. Beyond that limit, you cannot - nor should you - go.

Occasionally, in Blogger Help Forum: How Do I? we see the anguish

Where did the spam, on my blog, come from?

These queries come from people whose blogs have been successfully attacked, by hackers or spammers, and who now see content which they do not appreciate, being posted in their blog.

Leaving blog open to public authorship will make your blog spammer friendly.

If you were to voluntarily let anybody post in your blog, without requiring that anybody hack to gain control surreptitiously, your blog will become very popular with spammers.

After spammers saturate your blog content, your genuine friends will find elsewhere to post - and your remaining friends will be spammers. And your new friends (spammers) will tell their friends (more spammers), about a blog which accepts ads (posts) from everybody.

Your blog will be late classified as a spam host.

Shortly after this happens, your blog will be - righteously - classified as a spam host, and taken offline. And if you cannot show any non spam content, it will likely stay offline.

We're sorry, but your blog cannot be restored. It was recently confirmed as spam. Blogger suggests that you read the TOS.

You are responsible for content distributed by your "guest authors".

Another thing to consider, as the owner of a "host" blog, where "guests" post contributed material, is that you will be responsible for the content posted by your guests - whether you let the world post - or designated members.

• If you allow guest posts in your blog, you, as the blog owner, are responsible for the content of those posts.
• If your "guest" posts the same material elsewhere (as in his own blog, or a third person's blog), and search engines index both blogs, both blogs may receive "duplicated content" penalties.
• Nobody benefits, from duplicated content.

Unfortunately, you have to develop your blog content, yourself. Don't expect the public to provide your content for you - and plan to keep your blog online for long.

What Does Stats Provide, That Third Party Visitor Activity Meters Cannot Provide?

Not all blog owners realise how unique Blogger Stats is, in its design.

Some owners may idly suggest that Stats can easily be replaced by any third party visitor activity log / meter.

Why bother to use Stats? Since Blogger Stats shows referrer spam, it's pretty useless - just use SiteMeter, StatCounter - or Google Analytics.

They have no idea why Stats was designed as it is, nor what information Stats provides, that no competing product can possibly provide.

Every add-on accessory, such as any visitor activity counter / log / meter, has to be manually installed in your blog.

Most visitor activity counter / log / meter products require installation.

Simple accessories, which depend upon your visitor clicking on a link, can be installed easily - just add a clickable link on your blog - either in a post, or anywhere in the body of the blog. Visitor logs or meters such as SiteMeter or StatCounter, in order to produce usable statistics, can't depend upon the blog readers clicking on a link.

Most such accessories use add-on JavaScript code, installed in the body of the blog (as an accessory gadget), or in the blog template (installed using "Edit HTML"). With add-on code, that references any external server, the installed location on the blog page, of the accessory code, is crucial.

• Install the add-on at the top of the web page (or in the template code), and as your reader loads each page, he / she gets to watch the page load pause, as it waits for a distant accessory server to respond (while recording the visit).
• Install the add-on at the bottom of the page, and any reader, who closes the display before the page finishes loading, will not be counted by Analytics / SiteMeter / StatCounter.

In either case, the page takes longer to load. This causes reader impatience, and motivates the reader to close the display before the page finishes loading. The result - your blog gets one less new reader.

Most visitor activity counter / log / meter products are affected by filters.

Besides reader impatience causing statistical inaccuracy, all third party accessories that use JavaScript have a second problem - script filtering by our readers.

Analytics, SiteMeter, and StatCounter are known to be explicitly blocked, by some browser setting or third party application that may run on any given client computer. Some security products specifically list "sitemeter.com" or "statcounter.com" in their Block Lists.

A lot of malicious activity, encountered when surfing the web, can easily be blocked by proactive script filtering - just permit scripts, from any given domain, only when explicitly told to do so.

Every reader uses security accessories in the browser and on the computer - and many security accessories and settings provide script filtering. Most security is now provided as "deny by default, permit only on demand".

Most security products update automatically, as updates are produced - and this leads to other problems. Many of our readers, who are concerned with security, or who use computers that are well protected, may not be counted, consistently, by Analytics, SiteMeter, or StatCounter.

Stats does not require installation, and is not affected by filters.

Blogger Stats avoids the issues of page load delay induced impatience, and client filtering, by not using JavaScript add-on code. Since Stats is a Blogger accessory, it can retrieve data directly from the access logs produced by the Blogger servers. Access to server access logs:

• Does not cause page load delays.
• Is not subject to page load delay impatience.
• Is not subject to reader security settings.
• Does not require installation of any accessory, on individual blogs.

Besides the problems of our readers visits not being counted, we have the issue of what information is provided, and for what period of time. If you have installed SiteMeter or StatCounter on your blog, look at the displays provided. Each product will mention a limit of either 100 or 500 log entries - and will display details or statistics based upon the log used.

Many Blogger blogs get more than 500 visits in a single day - requiring blog owner visits to the log website at least daily, or to pay for extra service, to provide any benefit. And of course, that log was started only after the product was installed.

Blogger Stats, on the other hand, is able to provide statistics for the current day, week, month, and for "all time" (starting in May 2009, for all blogs in existence at that time).

Stats does not discard old statistics, they just extract from the server access logs, for any time range provided.

• All time.
• Last 30 days ("Month").
• Last 7 days ("Week").
• Last 24 hours ("Day").
• Last 2 hours ("Now").

Any blog owner can see any available statistics, at any time. Stats never has to be installed, by any blog owners - it is already there.

Stats is vulnerable to bogus activity records, created by spammers.

Unfortunately, the biggest strength of Stats - use of the server access logs to gather the visitor activity data - leads to its best known weakness - abuse by referer spammers, which leads to inflated blog read counts.

It may help to understand that referer spam did not start with Stats - nor is referer spam unique to Stats. Referer spam has been around ever since people published websites, and displayed a visitor log extract ("My Recent Visitors") to make their website more interesting to new readers (The suggestion that "This website should be more interesting to YOU, because it has readers from all over the world!").

Stats, like every visitor activity counter / log / meter product, resets totals.

Besides the concern of referer spam, we see various evidences of confusion about Stats displays.

• "Daily" counter resets that occur during the day - never at midnight.
• The inability to compare detail in one display, with aggregated counts in another display.
• Inability to display pageview counts for all posts in the blog.

All of these limitations are simply the direct result of how Stats is designed.

Every visitor activity counter / log / meter product differs, from every other product.

In reality, both Blogger Stats and third party visitor activity logs or meters have their respective advantages - and neither choice can ever replace another.

• If you want to see demographic details about some readers of your blog, you can use Analytics, SiteMeter, StatCounter - or any number of third party visitor activity logs and meters - after the chosen accessory has been installed.
• If you want to see comprehensive statistics about all readers of your blog - without being limited by install time or reader security policy - only Blogger Stats will help you.

Fortunately, all products are free - and Stats requires no installation. Your Stats data is there, waiting for you - on the Blogger dashboard menu.

Account Recovery, Evaluated As Return On Investment

Too many Blogger blog owners, seeking recovery of a long dormant account, overlook the realities of the Blogger business relationship.

I started the blog 10 years ago, I have forgotten the password, the email address is long gone - and I need the blog deleted now.

When told that deletion is not possible, if you cannot provide proof of ownership, they next ask for personal assistance.

But isn't there a person to whom I can explain my problem? Surely we can reach some understanding!

The reality is that Blogger wants to help their customers - when helping their customers provides them some business benefit.

Any business, that hopes to remain a business for any amount of time, has to understand the realities of Return On Investment, combined with Risk Management.

One basic calculation of ROI is

(Sum of benefits) / (Sum of costs)

Both benefits and costs can be tangible (income, expense, etc) and non tangible (inconvenience to customers, increased / decreased reputation, etc). Projects which provide more ROI can be scheduled, with more urgency - and projects which provide less ROI, with less urgency.

In problem management, problems which affect many people, when solved, produce some benefit. Problems which affect few people, when solved, produce little benefit.

A project which involves account recovery requires individual assistance, and benefits only the claimant - thus provides very little benefit.

It will require considerable research, to verify the identity of the person who setup an account or blog, and to verify the identity of the person asking for assistance - thus much cost. Additional cost would be the risk of encouraging more Blogger blog owners to overlook the necessities of blog ownership - and to not bother with remembering account name and password - thus ensuring more of the same, later. And there's the risk of enabling a deceptive blog hijacking.

ROI for most account recovery projects is very low.

A project which requires blog deletion (when ownership cannot be proven by the
claimant) provides even less benefit than simple account recovery - as the only result is the removal of one dormant Blogger account / blog. And it involves the same cost - both the same amount of research - to verify identities - and the same risk of encouraging more, similar thoughtlessness. And again, there's the risk of enabling a deceptive blog hijacking.

ROI for blog deletions is even lower than for simple account recoveries.

Both account recovery and blog deletion, when accepted as activity in the Blogger Support action queues, will, out of necessity, not receive high priority.

The memory of impatience, from previous claimants, will motivate many Blogger experts and Blogger Support staff to simply quote the Google Help advice.

At Google, we take your privacy and security very seriously. Therefore, we're committed to returning accounts only when we're sure we're giving them back to the accounts' owners. Because Google doesn't ask for much personal information when you sign up for an account, we don't have many ways to verify that you own an account.

Some advice given will be somewhat perfunctory.

Please, read the FAQ, and objectively consider the bigger picture.

This attitude, too, is an expectation of low ROI - special service demanded by people who never did anything with their blogs - and now, plan to simply move their blogging activity to WordPress.

A Hint Will Not Always Recover Your Access To Your Blogger Account

Some Blogger blog owners, trying to regain access to their blogs after a long absence, attribute their problem to over indulgent security measures.

I have too many email accounts, and no way can I remember all of them!

and maybe even

I have too many GMail accounts, and no way can I remember all of them!

Our suggestion will be, that they should carefully check all email (GMail) accounts. Their next request seems like a final solution.

Can Blogger just give me a hint, so I can remember which account I need to check?

Here they are asking for a last ditch effort, which is not guaranteed to bring success.

There are several reasons why requesting a hint - just a few characters of the email (GMail) account address - is not guaranteed to produce beneficial results.

• The hint request may be made by either a would be hijacker - or the possible later victim of a hijacker. The hint request invites focused brute force password guessing, which involves
  • Increased load on Google network resources.
  • Later problem reports about another stolen Blogger account / blog.
• A hint will not be given immediately. Blogger Support has several long queues of essential tasks. Helping somebody regain access to their Blogger account, after the would be owner has rejected the offered several automated tools, is not going to be at the top of anybody's task queue.
• A hint may not provide the right clue. Blogger Support will provide a limited number of characters in any hint - and cannot guarantee that the characters provided will be meaningful to the would be blog owner (or possibly, would be blog hijacker).
• Only one hint can be provided. Blogger Support won't provide an online game of "Hangman", by providing a new hint, until you guess your account name. One hint, only!

With all of these details in mind, and if at all possible, please do everybody a favour and make some effort to remember your account name and password. Don't count on Blogger to tell you your account name. Try the improved Google account recovery wizard, and check every email account which you may have possibly used, before asking for special attention.

>> Top

Country Code Based Aliases Will Interfere With Filters

As the Country Code TLD aliases, for blogs published to "blogspot.com", become more and more noticed, incidental problems are being reported.

For people who are security minded, as well as people who are conscientious about what is permitted on their personal computer, a few domain based filter related problems should be obvious.

Where are the pencil / tool icons on my blog?

and

Why can't my readers comment on my blog?

are just a couple examples of the various questions being seen in Blogger Help Forum: Something Is Broken, since the CC TLD aliases went into effect last week.

As with any layered security feature on our computers, local country domains affect our blogs in several ways.

• Content filtering.
• Cookie filtering.
• Script filtering.

These are all concerns, for both the blog owners, the blog readers, and of course Blogger Support.

Any filter, which permits cookies and / or scripts from "blogspot.com", needs to be checked - and to permit cookies and to permit scripts from the country local domain, that's relevant to the location of the computer being used. Note that with computers located near international borders, the owners may need to consider the country local domain for the countries on either side of the border.

• "blogspot.com.au" - if the computer receives service in Australia.
• "blogspot.in" - if the computer receives service in India.
• "blogspot.ca" / "blogspot.mx" - if the computer is located in northern / southern USA (or Canada / Mexico).
• Any future added CC TLD alias - if the computer receives service in the relevant country.

The blog owner, and the computer owner, must accept responsibility for filters.

As always, I will ask you to remember that Blogger Support cannot support the filters affecting your personal computer. Both blog owners, and blog readers, have to check all filters in their browsers, their computers and their networks.

Any local filters are the responsibility of the "owner" of the computer in use - whether the "owner" is the blog owner, the blog reader, or someone supporting the blog owner or reader. There are several problems, reported periodically.

• Commenting, on blogs which use the embedded comment form.
• Editing the blog template, using the Template Designer "Live Preview" window.
• Editing a post, and using the "pencil" or "screwdriver / spanner / wrench" icon.
• Editing a post, and using the "Preview" button in Post Editor. The "Preview" button, like the Template Designer "Live Preview" window, will require third party scripts to display a "blogspot.com" / "blogspot.com.au" / "blogspot.in" / whatever alias follows next, page from a "blogger.com" script.

All of these issues are related, in some way, to domain based cookie and / or script filters. And all of these issues, when reported, involve personal use of a computer - and can't be exclusively resolved by contacting Blogger / Google Support.

Some of the above problems, like a similar issue with custom domain publishing, may be seen on any computer used by the blog owner - or by any blog reader.

There may be workarounds, depending upon the actual problem.

If you are a blog owner, and the redirection is causing you problems, it's possible that you could work around the problem, by using the "No Country Redirect" modifier - if use of the "/ncr" modifier does not cause secondary problems, like language used.

If I had a problem with my blog, published as "bloggerstatusforreal.blogspot.com", I could access it as "bloggerstatusforreal.blogspot.com" in any country subject to the CC based redirect, by using the URL "bloggerstatusforreal.blogspot.com/ncr". This is, unfortunately, not likely to help our readers with their problems.

Please, don't be misled by advice to use clever JavaScript based redirection of blog traffic, to the "/ncr" alias, as an alternative to Country Code alias redirection. Clever solutions will not work well for you, in the long run.

Why Can't Blogger Just Tell Me The Email Address?

We see the pain, in Blogger Help Forum: Something Is Broken, of blog owners who do not understand the need for keeping the name of their Blogger account a secret.

I forgot the email address that I was using. Why can't Blogger just tell me the address??

and some ask

How did this unknown person "xxxxx xxxxx" get control of my blog?

Years ago, the local police would have to convince home owners

Please, stop leaving a spare key under a rock, near the door!

Both many blog owners (today) - like some home owners (years ago) - had the same basic problem - naivete.

Like the home owners of years ago, who kept a spare key under a rock near the front door, for emergencies, blog owners will use tricks to remember their password.

Don't - please don't - use a guessable password!

One favourite technique, for remembering the password, is so obvious.

Pick a password based upon something that you can remember.

For a blog owner who is married, the answer is obvious.

What is my spouse's name?

and there's your password. If you forget that, you have worse problems, that cannot be addressed here.

If the name of one's spouse was a secret, using the name would not be a problem. But knowing that many blogs either contain the name (and picture, maybe) of the whole family - or lead to a Profile page or website (FaceBook, Instagram, Twitter, ...) with similarly useful information - how secret is the password going to be?

Hackers love blogs with guessable passwords.

Knowing both the Blogger account name (email address) that owns any blog of interest, and the URL of the blog, any hacker has a simple enough task.

1. Scrape blog content, into a text analyzer.
2. Extract a few hundred details (spouse's name, and others) from the blog content, as analysed.
3. Run the known details through a password generation program.
4. Now, the hacker has a database, containing "10,000 good possible passwords", specifically relevant to this blog.
5. Go to "www.blogger.com", plug in the account name, and try out the 10,000 passwords, one by one.
6. That's a simple brute force password attack.
7. Sit back, and watch any botnet, controlled by the hacker, go to work.
8. Given enough time, the hacker very likely gets access to the Blogger account, and to the blogs owned by the account.

Steps 1 - 8, for any experienced hacker, will be summed into one step.

Plug in the URL of the blog.

Everything needed is just more coding - and a nice robust botnet or two.

The hacker, of course, will be targeting thousands of different blogs, simultaneously. So what if he (she) fails to find what details she (he) needs, to steal your blog? He'll (she'll) gladly settle for another - while the botnet works on yours.

Besides using a "strong" password (which carries it's own risks such as forgetting the password - and now we're here, again), the best way to prevent a brute force attack is by preventing step 5.

Keep the account name / email address a secret.

Additionally, if you have a blog and a business - or otherwise exchange email with strangers, separate your Blogger / Google account and your email account. Use two separate email addresses, for Blogger and email.

Learn to appreciate efforts made, by Google, keeping your account and blogs safe.

If you need to recover access to your Blogger account, don't expect to use the Blogger "Forgot?" wizard, plug in your blog URL, and get a reply

Email was sent to your address xxxxxxx@yyyyy.zzz

And, if you post in the forum.

Please email me advice, to "xxxxxxx@yyyyy.zzz"!

expect to get a stern warning

Please, do not post Blogger account names, or email addresses, in the forum.

People objecting to the recent Blogger policy of masking email addresses, in Blogger commenting and similar services, as "no-reply @ blogger . com", may also need to consider this very real issue. Possibly, even use Google+, instead of Blogger commenting, for networking with ones peers.

Google tries to identify brute force attacks, and takes action when possible.

And, if your Blogger / GMail / Google account is disabled - and you get a mysterious notice about

Suspicious / Unusual activity on your account

this could well be the other side of a brute force attack against your account, intercepted by Google.

Don't be offended by the various precautions.

• The unpopular "24 to 48 hour" waiting period, which you endure after getting the account enabled.
• The painful diagnosis of "hacking detected" against your account (aka "suspicious" / "unusual" activity).
• The annoying inability to access your Blogger account, when traveling.

If you find the precautions and problems to be unacceptable, consider using Google 2-step verification, to protect your account against brute force hacking.

This is not fiction here - it's all very real.

None of this is fiction or paranoia - it's based on some very real, recent events, and even involves a recent National Scandal - and leads to some very real conundrums.

Similarly, we have a very distasteful answer, to a seemingly worthy need. And another apparently "ceremonial" but necessary answer, to somebody in need of understanding and support, that can't be provided.

You have to make the effort, to maintain and protect your blog.

You will get no sympathy, when you complain how unsupportive Blogger is.

You have to make some effort - and remember some basic information - if you are going to maintain a Blogger blog. And, encourage your friends to keep their accounts and blogs safe.

Account Recovery, Authentication, Contact, Privacy, And URL Availability Are All Related

Every day, we get various impassioned pleas from blog owners (active, former, and would be), in Blogger Help Forum: How Do I?, requesting assistance.

How do I get access to my blog, that I published 10 years ago?

and

How do I keep my blog from being visible in Google?

and

How do I contact the owner of a blog that was published 10 years ago (and never updated)?

All of these are valid concerns - and answering one question sometimes involves referring to various other concerns.

Blogger Support, some time ago, confirmed our right to privacy, as blog owners.

Our policies aren't pro-stalker, they are pro-respecting the privacy of user information. We simply can not release information without due process.

Effective use of the Internet requires some amount of ownership privacy.
The concept of Internet privacy in general, and blog owner privacy specifically, has legendarily been part of some major world political events. If we as blog owners are going to retain our rights to privacy as blog owners, we have to be aware of the limitations, and the results.

Not all blog owners are aware of the complex natures of Blogger authentication. We have two long used authentication options - account name / password (primary), and backup email access (secondary).

Some blog owners refuse to remember their account name and password, routinely.
Some owners routinely ignore the primary option, and use the secondary, regularly. When their email address changes because they change employer, graduate from college, or change ISP, we see the plaintive cry from former owners

I need Blogger to send the recovery email to my new address!

or

I can't use my previous email account!

To prevent the latter issue, Blogger / Google recently introduced a tertiary authentication option - SMS / Voice Recovery. This allows us to use a text message (SMS transmitted), or a voice message ("home" phone transmitted), to the "cell phone" or "home phone" of our choice. This approach, not universally popular, causes another privacy concern.

• It requires advance action. People currently unable to use the primary or secondary authentication options are not going to find a solution here.
• It requires the blog owner to register a "cell phone" or "home phone" number. People with privacy concerns don't appreciate this.

  I'm not giving Google my phone number!

  as if Google intends to add us to another phone spam database.

There is no Blogger required minimum publishing level.
Another privacy issue involves people who think that blog ownership involves some minimal publishing activity, and who require use of the Blog URL to match their blog subject and title.

I need contact to the owner of blog xxxxxxx!

Here, the would be blog owner ignores the owner's right to privacy, in requiring contact information.

Some people request that Blogger monitor posting level, and contact inactive blog owners.

Can Blogger just email owners of blogs with no posts for a year, and ask them to confirm their intention to continue? Those who don't respond can have their blogs taken away, so somebody else can make better use of the URL.

These would be owners seem to think that all Blogger accounts are based on active and valid email addresses, and that all URLs should be universally monitored.

Blogger can't satisfy everybody - you may have to pick an available URL!
The bottom line here is that there are several limitations, that we may have to learn to live with.

• Blogger won't disclose blog owner details, gratuitously.
• You, and you alone, are responsible for maintaining control of your blogs.
• If a given URL is not available, find one that is available now, and start your blog, today.

Compromise, and move forward. Remember, blog content is the value, in your Internet presence. Don't require that Blogger compromise security, to give you improper access to your blog.

Blogger Is Not Blocking Access To Your Blog

I've explained the issues about Blogger account maintenance, and blog access, so many times.

I've described it as possession being the law, or as reading between the lines, or even as responsible practice - and some people just don't understand these issues. Some people try to describe their problem, when they have a problem, as Blogger unlawfully stealing their possession.

Blogger won't give me access to my blog - do I need a court order to get access to my blog, and to my content?

At first glance, they have a point - Blogger has to give us access to our blogs, or they cease being our blogs. If you look closer though, there's a flaw in that reasoning.

Blogger lets you publish a blog, without identifying yourself legally to them, as long as you retain control of the blog.

To retain control, you have to access a Blogger account that owns the blog. You have two methods of access, to any Blogger account - a front door, and a back door.

1. The front door: The account name (email address when setup originally), and the current password.
2. The back door: The email address currently associated with the account, and access to that email address.

If you lose both the front door and the back door, you can't access the Blogger account, and you can't control the blog. If you lose access, don't blame Blogger for your loss of access.

Blogger is not preventing you from accessing your blog, and doing whatever you wish, with your blog - as long as you can prove that it's your blog. Blogger will assist you, when possible, to access your Blogger account, and your blog.

When you make it impossible, as when you lose both the front door and the back door, they can't assist you. If they can't assist you now, they will still hold the blog, patiently, until you are able to prove that it's your blog.

Your blog is still there, waiting for you to access it. It will remain there, waiting for you to access it. Blogger is not preventing you from accessing your blog.

Blogger Provides Blog Access Using Two Factor Authentication

Many bloggers are confused about how to protect their blogs, both from unauthorised administrative access, and unauthorised viewing. An example of the confusion is the occasional question

How do I set a password in my blog, to prevent unwanted viewers?

and the correct answer here is simple.

You can't set a password. Blogger uses two factor authentication, to protect your blog.

If you own a house or a car, you may occasionally wish to provide guest access to your house or car. Maybe you have an extra key, which you lend to your guests, so they may use your house or car at their convenience. If you've done this, you may observe inconveniences caused by availability of a shared key.

• A key may be lost, necessitating re keying of the locks, and distribution of a new key to all who have access.
• You may not wish for your guests to have access to the entire house or car, at all times.
• You may not wish for your guests to have access to the entire house or car, permanently.
• Your guests may decide that carrying another key, on a separate key ring, may be too much trouble. They may wish to put your key on their key ring. This can cause more complications.
• Distributing, and maintaining, a key library to everybody may simply be a lot of work.

In higher priced houses or cars, people have discovered the advantages of using electronic locks, which can provide more choices than simply providing a single key, available identically to everybody.

Blogger uses two factor authentication, which is equivalent in sophistication to the electronic lock which you use (or may wish to use) on your house or car. This allows you, and your guests, convenient and protected access to your blog. Two factor authentication provides more convenience, and protection, to both of you.

• You identify your guest by their public email address, and send them an invitation to your blog.
• Your guest accepts the invitation, using the Blogger account of their choice, and using their own personal password.
• You are safe from your guest, and your guest is safe from you, from either of you knowing too much about each other.

If you wish to provide additional access to your blog - either another administrator, another author, or a designated reader, use the Settings - Permissions wizard, and add a member of the appropriate type. That's how you manage blog access.

>> Top

Valentine's Day Is Coming - Celebrate With Care

This Sunday, many bloggers will celebrate another important holiday in the year - the holiday of celebrated relationships, aka Valentine's Day. Some bloggers will decorate their blogs, using a Valentine's Day standard - falling hearts.

Incautiously chosen relationships cause pain and suffering - some even known as "the gift that keeps on giving", aka an STD. Some incautiously chosen falling hearts decorations have recently been found to cause another "gift that keeps on giving". At least one falling hearts variant, provided free by a hacker, has been reported as causing a blog hijack, noted by several bloggers in Blogger Help Forum as a "sendptp.com" hijack.

Like STDs, the blog hijacks being discovered recently don't always show up immediately. Normally, when people write in to the forum reporting

I´m being hacked! Every time I type the address to my blog, I´m getting redirected!

we advise them to remove any recently installed third party accessories.

Recently, the victims of "falling hearts" and its predecessor "falling snow" have reported having installed their problem accessory some time ago, and just recently noticed the hijack problem. A few accessories are removed, before the problem is discovered and removed.

It's possible that these accessories are being released intentionally, as stealth hijacks. Like STDs, you won't see the problem, until long after the fun is gone.

If you choose a "falling snow", "falling hearts" or maybe "falling flags" (for Fourth Of July?) decoration for your blog, choose with discretion. Don't wait for your readers to write to you

Why do I get a page full of advertisements, instead of your blog?

Remember - security for your readers begins with you.

>> Top

Transferring A Blog From One EMail Account To Another - An Alternate

I've written about the simple procedure of transferring a blog from one Blogger account to another, and how simple it should be.

Sometimes reality steps in - and the normal transfer procedure won't work.

• Maybe you don't want your EMail (GMail) address known by the current blog owner.
• Maybe the two EMail addresses are thoroughly tangled - you invite the second EMail address as a blog member but just don't get the email - even in "Bulk" or "Spam"! What to do?
• Maybe you opened the invitation email under one account, but were logged in to Blogger using the other account. This can happen if you execute the transfer, using just one browser.

Sometimes, having ignored one or two basic (to me) rules of Blogger account existence, you just can't send a membership invitation to a second Blogger account.

Here's where we think outside the box.

• Setup an extra email account, based upon any non GMail email address. I'll suggest Yahoo.com as an example here - but you can use whatever email service works for you.
• Go to Settings - Permissions, and add your new Yahoo email address as an invited member.
• For the Yahoo email part of the process, use a separate browser. If this browser has been used before, clear cache, cookies, and authenticated sessions, restart the browser, and login again to Yahoo. Start with a clean browser here.
• Go to your Yahoo email account, and open your email. Remember to look in your "Bulk" or "Spam" folder, if you don't see anything in "Inbox".
• Accept membership in the blog.
• When you're asked for an account / password, select "Use a different account"!
• Enter the second Blogger account name (address), and the correct password for that account.
• Go back to the Permissions display, and refresh.
• Verify that you have a new member in the Author list.
• Return to the normal procedure, and complete the transfer.

A little extra work, that. But if you need to transfer control of the blog, to make it possible to manage the blog from the other Blogger account, it's probably worth it.

And, next time you transfer blog ownership, you will (hopefully) use two browsers, in the transfer.

Privacy Has Limitations

If you own a computer, and use it where there are other people - maybe in your home or office - you may setup your computer so certain files can only be read and / or updated by you.

Maybe you decide just you and one other person - or you and a select number of other people - should share access. That's your decision, and one of the features of Windows Networking and similar file sharing protocols is the ability to have and to maintain private files and folders.

Built in to Microsoft Windows, and other network operating systems (aka "NOS"), is the process of "authentication" and "authorisation" - that is, "Who are you?" and "Should you be doing this?". A major portion of any NOS does just that, constantly.

There is no similar feature in the Internet, using HTTP (or HTTPS).

As originally designed, all Internet content is published to be accessible to everybody, equally.

No browser or Internet server provides authentication and authorisation, to the same level of detail that is provided by an NOS. Any concept of "private" content, and / or Internet "security" is provided at different, and seldom equal, levels of detail.

These are details which are not understood by everybody.

I have a private blog. People who are not members of my blog are reading, and leaving comments.

or

Why do I see my private blog mentioned in search pages?

or

Why can't I make some portions of my blog public, and other portions private?

or

Why do I have people reading my blog, who I did not invite to read my blog?

And similar questions show that people don't understand how well NOSses do their job, and how well similar (but never equal) Internet functions will never do so.

On the Internet (in general), and in Blogger blogging (in particular)

• Blogs that are made private won't be so, immediately. Blogs that were public, for a while, have cached content which won't disappear, immediately.
• Blogger lets us have private blogs. Blogs made private by Blogger aren't as granular as protected content in an NOS.
  • A private blog may be accessed by people who you don't know, but who know people that you invite as members.
  • A private blog may be accessed by people who you don't know, but who work with people that you invite as members.
  • You can't have a blog with some public posts, and some private posts.
• A private blog may not be closed to search engine spiders. A blog that's closed to search engine spiders may not be private.
• If you have a problem with a Private blog, we can't view the blog, or use any online diagnostic utilities, to look for problems.

So enjoy your Private blog, if you like - but be aware of the limitations and problems, which will be your responsibility.

>> Top

Identifying Your Visitors

Just about anybody who owns a blog has, one time or another, wanted to find out more about a specific visitor to a blog.

Generally, we might need to find out about a person who leaves a specific comment, so we can block or take other action to prevent unwanted comments. With a properly chosen visitor log, this isn't difficult.

With a comment, for instance, we start from the comment.

• Note the date and time of the comment, and what post it was published against.
• Examine your visitor log, and find all clicks against the post in question, immediately preceding the comment in question.
• Find the visitor log entry that contains a reference to the comment viewing and / or the comment posting process.
• Now, you have the IP address of your malicious commentor, and an assortment of demographic details, possibly including an approximate location.

This is a key process in keeping malicious comments out of our blogs. But note the limitations here.

• You cannot say, for sure, that two clicks from the same IP address are, in reality, the same person. On a shared computer, say in an airport or a library, one IP address could be shared by any number of readers.
• You cannot say, for sure, that two clicks from two different IP addresses are, in reality, two different people. One person could have Internet service that provides a dynamic IP address assignment. In a space of 30 minutes, one person could, sequentially, use 3 different IP addresses.
• In no case can you say, for sure, exactly where a person is located.

And if you examine the visitor log of your choice, you might observe the URL which was viewed by one or more visitors immediately before they viewed yours. This is known as the "referer" URL. Try not to be concerned or offended, if you see indications of visitors from an unsuitable website name - or maybe from a country or geographic region known for inhabitants who engage in hacking and other misbehaving. People in China, India, Russia, the USA, and other countries, have legitimate reasons for reading your blog - just as people in other countries do.

Neither the demographic details, nor the "referer" URL, should by themselves indicate any hacking activity taking place, in an attack against your blog. And there is no law or regulation which restricts the right to link to any website on the Internet. If you have a public blog, and you spend time publicising your blog, then you're going to get visitors.

So use a visitor log - but use it wisely.