Commenting Requires Login, To Suppress Spam

Some blog owners don't understand the need to identify themselves, when commenting on our blogs.

We see an occasional question, in Blogger Help Forum: Get Help with an Issue, about comment authentication.

Why, if I've selected "Anyone - including Anonymous Users" under comment settings, for "Who can Comment?", do my visitors complain of having to login?

This blog owner, like many others, does not understand the Blogger spam mitigation policy, in Blogger Comments.

Blogger lets us select who we wish to allow to comment, on our blogs.

When we do not moderate, they require authentication, to cut down on the spam. Moderated comments, with CAPTCHA ("Show word verification") not required by the owner, appear to go straight to moderation.

Comment authentication makes genuine comments more normal.

By requiring authentication, Blogger makes it more likely that a comment, awaiting moderation, will be genuine - instead of more spam. This encourages us to moderate comments more frequently - and helps us publish moderated comments, more promptly.

And more frequent moderation discourages spam - and makes it more likely that we will see actual comments, later.

Blog owners choose how to allow comments.

As a blog owner, it's your choice how / whether to allow comments.

• Anyone - includes Anonymous Users.
• Everybody with a Google, or an OpenID, account.
• Everybody with a Google account.
• Blog members only.
• Comments disabled.

Blog readers choose how to publish comments.

Depending upon the choices that you provide, your readers choose how they may authenticate.

• "Anyone" allows a reader to comment anonymously - or identified.
• If they wish to comment anonymously, they login, using a CAPTCHA.
• If they wish to comment using a profile, they login, using an account.
• Login is generally only required, with the first comment.

"Anyone" allows a reader to comment anonymously - or identified.

"Anyone" allows anyone to comment anonymously (if they wish). To cut down on spam, anyone commenting has to login.

If they wish to comment anonymously, they login, using a CAPTCHA.

Solving a CAPTCHA lets them remain anonymous - but still identify themselves as a person, not a bot. Any comments, awaiting moderation, or published, are more likely to be genuine - not spam.

If they wish to comment using a profile, they login, using an account.

They can login, as permitted, using a Google or OpenID account. Anyone able to login with a Google or OpenID account can still publish a comment anonymously, if they wish.

Login is generally only required, with the first comment.

If someone has to login repeatedly, to comment, they have a problem with identification, and filters. With cookies and scripts properly permitted, login (with the first comment) will be remembered (with any later comments).

The Blogger / Google login status, and the ability to post comments, is sensitive to both cookie and script filters. Your readers may need to enable (stop filtering) "third party cookies", in their browser and on their computer - if they wish to comment, most easily.

---

Both a #Blogger blog owner - and blog readers - get choices how to authenticate when commenting. Depending upon the choices made by the owner, the readers get more, or less, choices.

Confusion From Comments And The CAPTCHA

This week, we're seeing complaints from quite a few angry blog owners, in Blogger Help Forum: Get Help with an Issue.

Why do I have to solve a CAPTCHA, to comment on my own blog?

and

Everybody sees a CAPTCHA - even if they are logged in to Blogger!

Previously, the CAPTCHA was visible only to those not logged in to Blogger, or to those wishing to comment, anonymously.

It appears that the full page and popup window comment forms were updated, possibly to make the CAPTCHA form more usable, for those blog readers who are using a computer subject to filtering of "third party" cookies.

The CAPTCHA appears to be always required.

The effect that we are now seeing is that the CAPTCHA appears to be required, for all comments, when the full page and popup window forms are used.

In some cases, even with the CAPTCHA displayed, you can publish without solving.

• If you are authenticated, the reCAPTCHA, though displayed, may not require solution.
• If you are authenticated, and a blog member, neither the ezCAPTCHA nor the reCAPTCHA should require solution.

In either case, simply compose and Publish your comment.

People who wish to publish anonymously will always have to solve a CAPTCHA.

Unfortunately, people who are publishing anonymously will still need to solve the CAPTCHA. The non optional reCAPTCHA, which gets displayed, is not as easy to solve as the optional ezCAPTCHA.

Cookie filtering, once again, may be part of the problem.

To increase the confusion, people using a computer where "third party" cookies are filtered will be treated as if they are publishing anonymously, and will have to solve the reCAPTCHA. Some people, who think that they are properly authenticated, will find out otherwise, if they try to publish a comment without solving the CAPTCHA.

Continuing to cause confusion, in some cases, comments entered may simply vanish, if the CAPTCHA can't be displayed when necessary. This, is another consequence of cookie filtering.

Use A Blogger Blog As An OpenID Host

We see an occasional request, in Blogger Help Forum: Learn More About Blogger, about commenting and the profile used when authenticated.

How do I have my comments linked directly to my blog? I don't want my comments linked to my profile, with people having to hunt for my blog links!

This person does not understand why we have Bogger / Google / Google+ profiles, linked from our comments.

Even if we can't provide direct links to our blogs, when commenting using a Blogger or Google account - we can do that, if we can comment, using an OpenID account. An OpenID account links directly to our designated blog - when we specify the right blog URL, while logged in using OpenID, to publish a comment.

Your Blogger blog will provide an OpenID account, just as well as a FaceBook or WordPress account will do, for any Blogger blog using Blogger hosted commenting. Blogs using third party commenting systems may, or may not, support OpenID.

Blogger has been providing, OpenID authentication, for comments, for some time.

Getting OpenID to work - to allow comments using a Blogger based OpenID "account", is not automatic, however. The OpenID V1 tags, which are part of the standard Blogger blog header, don't work. You'll need to replace them, with OpenID V2 - and you will need a Blogger account, with a Google / Google+ profile.

Here, as always, I'll advise you to backup the template - before and after tweaking it.

You'll add 3 lines of code. Copy and paste 3 lines (which may display here as up to 6 lines, wrapped), below.

<link href='https://www.google.com/accounts/o8/ud?source=profiles' rel='openid2.provider'/>
<link href='http://www.google.com/profiles/nnnnnnnnnnnnnnnnnnnnn' rel='openid2.local_id'/>
<link href='http://www.blogger.com/openid-server.g' rel='openid.server'/>

Access the dashboard Template wizard, and use "Edit HTML". At the top of the header section, look for the "all-head-content" tag.

Change

<b:include data='blog' name='all-head-content'/>
<title><data:blog.pageTitle/></title>

To

<b:include data='blog' name='all-head-content'/>
<link href='https://www.google.com/accounts/o8/ud?source=profiles' rel='openid2.provider'/>
<link href='http://www.google.com/profiles/nnnnnnnnnnnnnnnnnnnnn' rel='openid2.local_id'/>
<link href='http://www.blogger.com/openid-server.g' rel='openid.server'/>
<title><data:blog.pageTitle/></title>

Then, replace

nnnnnnnnnnnnnnnnnnnnn

with your Google or Google+ profile id. And hit "Save template".

The next time you are preparing to comment, on a blog that supports OpenID based comments, select OpenID, and provide the URL of your blog.

You will have to login, using your Blogger account with the right Google / Google+ profile, and accept the comment. Other than that, it's pretty straightforward.

>> Top

The CAPTCHA, For Anonymous Comments, Isn't Going Away

Several weeks ago, Blogger added a security feature to Blogger commenting, to reduce comment spam.

Note: Even if you don't have word verification turned on, anonymous commenters might be asked to enter some text. This helps protect your blog from abuse.

This change has not pleased everybody.

I disabled "prove you're not a robot" for commenting. Why do my readers still have to solve a CAPTCHA, each time they comment?

This blog owner is not looking at the bigger picture. This new feature will benefit many blog owners - when Blogger is used, properly.

By adding a CAPTCHA, to the option to allow anonymous comments, we get several benefits.

• People can allow anonymous comments, without allowing uncontrolled spammer activity.
• People can allow authenticated comments, and not require a CAPTCHA.
• The overall level of spam, currently being seen on some blogs which allow anonymous comments and require no CAPTCHA, will drop. This will allow Blogger Security engineers the chance to concentrate, more intently, on the remaining spam.

Instead of restricting the ability for people to comment on our blogs, this change actually increases the ability for people to comment - and decreases the spam.

People who are logged in to Blogger - and who are visible as logged in - won't even see the new CAPTCHA, even if they want to comment anonymously. Only people who are not logged in (or who are not seen as logged in), and who wish to comment without logging in, will be inconvenienced.

The biggest problem, with the new CAPTCHA form, is with people who are seeing the CAPTCHA even when logged in - because they are filtering "third party" cookies. Those people will have the choice of logging in again, or solving the CAPTCHA.

Anybody who is not logged in can avoid having to solve the CAPTCHA, even if one is presented, by logging in to Blogger. Since the standard Google "One account" login is used, people who do not have a Blogger account can setup one, on the fly, in a couple of minutes. This option is not obvious, from the commenting form - especially with the CAPTCHA displayed - but it is present.

Since the commenting form comes in 4 versions, depending upon template type and comment form placement, Blogger Engineering will need to make a coordinated effort, to improve the overall design of the comment form.

The various buttons and links, which allow the comments to be published using the many options, will have to be displayed better - to make it apparent to everybody that logging in to Blogger can avoid use of the CAPTCHA - even if the reader wishes to not identify, by commenting anonymously. And, other improvements are needed, also.

And once again, I will point out that a better user experience will be had by all who can properly maintain their computers, and not block "third party" cookies. Anybody, who is able to login to Blogger, should be able to comment anonymously, without inconvenience of the CAPTCHA.

Some solutions in Blogger require our action - not just action by Blogger Engineering.

>> Top

Comments And Layered Security

One of the most common complaints, seen regularly in Blogger Help Forum: Something Is Broken, involves publication and visibility of comments.

Why can't I publish comments, on some blogs?

or

Why can't I see my comments, after I publish them?

or even

Why do my blog posts show no comments?

These are questions asked by blog readers and owners, alike. The answers all start with security filters and settings.

Security filters and settings affect the ability for you, and your readers, to use commenting, on your blog.

Comment Form Style

The majority of the problems, with commenting and filters, involve blogs which use the Post Page ("Embedded") comment form. Use of the embedded form requires third party cookies, on the reader computers.

The Full Page form is least vulnerable (though not totally so), of the 3 form styles. Embedded, Full Page, and Pop Up comment forms are all vulnerable, to differing extents, because of the different blogs, that attract different reader populations, each with differing abilities and needs to maintain security on their own computers.

The problems with comments involve the clients (ie, the blog readers), their computers, and their choices, reacting to the options chosen by the blog owners.

Security Accessories

Every different computer, accessing the Internet, has a different combination of security accessories. Every different security accessory will have its own filters - and be subject to updates, by the provider. And every different filter will be triggered, from time to time, by different components in the various Blogger (and Google+) comment scripts.

The commenting process - and accompanying security problems - involves many different details, besides comment form placement.

The blog URL, and the geographical location of the reader, will trigger filters. Both blogs subject to country code alias redirection, and those using custom domain publishing, will be affected by filters, in different ways. Both involve blogs not accessed as "blogspot.com".

Commenting Options

Authentication options, which are selectable by the blog owners, will vary.

• Anyone (no authentication required).
• Google / OpenID account.
• Google account only.
• Blog members only.

Within those 4 levels of authentication, the blog reader will have 1 to 3 choices. Each of those choices (by the blog readers), combined with each of those options (chosen by the blog owners), will involve different sections of code.

Besides the authentication choices and options, there are options (for the blog owner) to include CAPTCHA verification, and to include comment moderation and notification. Again, different sections of code will be involved.

The different sections of code involved will trigger different filters.

Comment Moderation

Besides the per blog choice to include comment moderation, the real time per comment choice of the blog owner, is to publish (or not to delete), or to not publish (or to delete) any given comment. This filter leads to the subject of community moderation, and training of the collaborative and heuristic filters, for Blogger hosted comments.

The community moderation filters provide automatic moderation of Blogger hosted comments - and the need for active moderation, by the blog owners.

Google+ Comments

The choice of Blogger hosted comments, vs Google+ hosted comments, provides one more option, to the blog owners.

Blogs which use Google+ hosted comments use community moderation, and free the blog owner to spend more time on blog content. Google+ hosted comments provide real time relation based filters, where the publisher of any comment can designate who will be allowed to view the comment, providing filters which are relevant to the comment publisher.

Cookies and Scripts

Each separate section of code can trigger different script filters - and may require different cookies, which may or may not be present and accessible to the Blogger scripts. Both cookies and scripts are essential parts of Blogger code, which are vulnerable to different security filters at different times.

The mysterious vanishing comments is just one consequence.

Use Of Supported Browsers And Computers

Some people prefer to ignore the crowd, and to use browsers and operating systems that nobody else knows about.

Individuality is good, in general - but in the world of web applications such as Blogger, use of unsupported browsers and computers may bring frustration. Blogger simply can't support all browsers and computers, with equal attention to the oddities presented by each one.

The End Result

The various filters involved cause comments to be published (or not), to remain published (or be deleted), and to be visible when published (or invisible). Many of these details are transparent, to the casual blog reader - until there is a problem.

These details may help to explain the apparent random nature of Blogger blogs and commenting - why comments, posted to some blogs, appear without problem - while comments, posted to other blogs, may never appear, or be invisible.

The Need To Comment, Anonymously, Has To Remain A Possibility

Not all blog owners understand the need for people to post anonymous comments, against our blog posts. Periodically, in Blogger Help Forum: How Do I?, we see the naivete expressed by some.

How do I find out who is posting anonymous comments to my blog?

These people do not understand the need for anonymous commenting.

You, as a blog owner, have the ability to select the level of authentication, to be required of anybody preparing to post a comment to your blog. For "Who Can Comment?", we find the selection list

1. Anyone - includes Anonymous Users
2. Registered Users - includes OpenID
3. Users with Google Accounts
4. Only members of this blog

People who wish to comment anonymously, yet provide a "Name" / "URL" to link back to their Blogger profile, or their blog / website, may do this at their discretion. Anybody doing this provides no guarantee of being genuine, however.

If you allow "anonymous users" to comment, then people who wish to comment anonymously need to be assured that their privacy will be respected. You can gather demographic data about your blogs visitors - and you may infer specific details about individual commenters - but the relevance of that policy will be limited by the precautions exercised by your commenters.

>> Top

Blogging Anonymously Has A Price

Blogger supports anonymity - both in our ability to maintain and to own a blog anonymously, and our ability to comment on blogs anonymously. But this anonymity comes with a price.

I need to contact the owner of "xxxxxxx.blogspot.com", but there is no contact information and the blog is private.

or

How do I find out who left an anonymous comment on my blog?

or

I can't access my blog - I forgot the password and the email address doesn't exist any more.

or

I deleted my account, and they won't give it back to me!

All of these are queries by bloggers who do not understand the price of anonymity.

If Blogger is going to preserve our anonymity as blog owners, and as commenters (on blogs where anonymous comments are allowed), they cannot give out any information, to anybody, that might disclose our identity.

Blogger / Google must protect anonymity diligently, to be trusted.

If Blogger / Google starts disclosing identity information, to people who ask casually, nobody will be able to trust our - or their - intentions.

If you let people comment anonymously on your blog, people will comment with the expectation that you won't be requiring any personal information, other than demographic information that's obtained through a visitor log. If you don't like anonymous comments, you either disable anonymous comments - or you moderate comments, and discard what you don't like.

You - and only you - must maintain your anonymous, multiple identities.

If you setup a new Blogger account, and then create a new blog, and you include no personal details in either the account or the blog, you will wind up with a Blogger account that cannot be recovered, if you ever forget the account name / password - or if the account is ever locked for "suspicious" / "unusual" activity.

Don't demand that Blogger break someone's anonymity, without legal need.

If someone publishes a blog without a Profile gadget, or publishes a blog privately, without including contact information somewhere, don't expect to casually write to Blogger and demand contact information. And don't try claiming to own the blog in question, and that you forgot the password - or that you cannot remember the many different email addresses that you may have used.

Blogger cannot disclose the identity - including the email address - of the owner, if anonymity is to be preserved. This includes if your blog is deleted, and you don't know the owner account.

You may have to find out owner identity, on your own.

It's possible that you can identify a contact, on your own. If you require contact information provided by Google, you'll need legal assistance, and a court order.