If You Travel, Be Prepared To Prove Identity

We're seeing reports from people who claim to be traveling, and who can't login and access their blogs.

Google appears to now authenticate us using current location, as well as account name / password. We see occasional reports, in Blogger Help Forum: Get Help with an Issue, about new security procedures.

I am traveling, and I need to access my Blogger account from another country. I know my account name and password - and I logged in successfully. But after logging in, I am still being asked to prove my identity!!

This blog owner is finding a problem, with Google taking extra measures to protect our accounts and blogs.

Google is trying to protect us, from people who access the Internet from different countries - and who try to access our Google accounts, and steal control of our blogs.

Somebody in a foreign land, accessing your account, may not be you.

If you normally access the Internet from your home, and you travel to another location and try to login to Blogger / Google, you may be asked for additional details, to prove that you are the legal owner of your Blogger account. You may feel like you are being treated discourteously, when this happens.

In reality, Blogger is simply trying to keep your blogs under your control, by preventing people other than you from stealing your Blogger account, blogs, and email account - and possibly, your friends Blogger account, blogs, and email account.

When you travel, you spend time preparing for the trip.

When you prepare to travel to a distant country, you are responsible for getting your travel documents (passport), permissions (visas), maybe make health preparation (update immunisations, get extra medications) - and learn a minimum amount of the local language, before you go.

Maybe you should also spend some time getting your Blogger / Google account in order (update any backup details, such as backup email address and phone number). Even, plan an account recovery, from time to time.

This is an excellent time to try 2-Step Verification.

You might even consider setting up Google 2-Step Verification - and generating a set of one time backup authentication codes.

If you don't prepare your account for travel, you may have to wait until you get home, to post to your blog. You may even be asked for proof of identity, when you get home, too.

The Google "One account" Login, And Cookie Filters

Thanks to the recently added Google "One account" login, all Blogger features are now vulnerable to "third party" cookie filters.

Long ago, many people who used Blogger would login to Blogger using a link in the navbar - or a similar Blogger login wizard.

http://www.blogger.com

Now, that login redirects to the Google "One account" login.

http://www.google.com

When referenced from a Blogger login, the latter URL becomes magnificently complex.

https://accounts.google.com/ServiceLogin?service=blogger&passive=1209600&continue=https://www.blogger.com/home&followup=https://www.blogger.com/home<mpl=start

Long ago, people who logged in to Blogger, using the Blogger login, had no need to worry about "third party" cookies and filters.

When blog owners logged in under Blogger, the dashboard worked transparently.

Everybody could use the Blogger dashboard and some Blogger features, such as full page and popup window comments, without any problems. A login cookie, created under "blogger.com", could be read under most Blogger features - such as a full page or popup window comment form, or the various Blogger dashboard components - without any thought to any "third party" cookie filters.

Not everybody understood the difference between the dashboard and blog features.

The lack of worry about "third party" cookie filters, with Blogger login, did cause some dissent. People able to use the Blogger dashboard in general, became rather skeptical, when told to allow "third party" cookies, to enable the Stats "Don't track ..." option, or maybe the embedded comment form - or various other Blogger features.

Some blog owners, when advised to change form placement, because of reader problems when publishing comments, might object because the full page or popup window form lacked features - but not all. A few objected, simply because they did not believe that cookie filters could be so capricious.

Some blog owners attributed the differences to poor design.

Occasionally, some owners would ask why the embedded comment form would be designed so negligently, to require third party cookies - as if Blogger intentionally designed their features, to make it difficult to use their service. At one time, the embedded form was re written, to use "blogger.com" content, embedded in an iframe - possibly to allow the CAPTCHA form, for embedded comments, to avoid the nefarious "third party" cookie filters.

With Google "One account", Blogger and Google, instantaneously, has made the entire Blogger service require enabling of "third party" cookies. If a login cookie is created under "google.com", it will need to be read under "blogger.com" (the Blogger dashboard utilities), "blogspot.com" (Blogger blogs, published natively), any country code aliases that might apply, and any Blogger blogs, published to custom domains.

There is no more confusion about "third party" cookie filtering, because some features may work, and other features, mysteriously, don't work. Now, all of Blogger (GMail, Picasa, YouTube, ...) will require "third party" cookies to be permitted, if a login cookie is to be consistently accessible - and all services are to work, reliably.

All problems are not caused by cookie filtering - and this expands the confusion.

Yet, "third party" cookie filters alone, do not explain all Blogger feature problems, that do involve cookies, in some way. Both the recently explored comment wizard CAPTCHA form, the interstitial warning displays, and the Reading List disappearances - all have other, complementary, issues.

Cookie filtering is just one detail, in the Blogger infrastructure - though when problems are seen, one should check and correct the filters.

Hopefully, as the need for third party cookies becomes more uniform in Blogger, everybody using Blogger can become objective enough, and stop inappropriate filtering. With third party cookie filters less critical an issue, maybe Blogger Engineers can identify the problems that they can, and should, solve.

Logging In To Following, Using The Google "One account" Login

Long ago, Blogger Following (aka Google Friend Connect) was part of a non Google community of social networks.

If you wanted to Follow a blog, you had to login to the Followers gadget, but separately from your login session with Blogger. This let you login to Blogger to maintain your blog, and to Follow other blogs, using any desired Blogger or Google account that you wished.

You do not have to Follow other peoples blogs, using the same Blogger or Google account that you use to maintain your blog - nor do you have to logout from your Blogger account that you are using to publish to your blog, so you can Follow somebody else's blog. This lets you separate blog ownership identity from blog Following and surfing activity.

As part of the separate login policy, Following let you login using any Blogger / Google account - or using any one of several non Google accounts, of an interesting variety.

Long ago, your selections, for logging in to Following, included an intriguing complement of hosts, for your Followers account.

• Google
• Twitter
• Yahoo
• AIM
• Netlog
• OpenID

Adding to the intrigue, you could choose from an interesting, and oddly differing, complement of hosts, for your Followers profile.

• Following (Default)
• Blogger
• Google
• Orkut
• Netlog
• Plaxo
• Twitter

With the coming of the Google "One account" login to Blogger, all of that is simplified. Now, to login to Following, as for Blogger, you get the normal Google "One account" login display.

The login display is carefully labeled, so you know that you are logging in to Following.

Sign in to continue to Google Friend Connect

Other than that label, what you see is the well known "One account" login display.

As with any Blogger / Google login, you can login to a GMail address based Blogger / Google account - or to a non GMail email address based Blogger / Google account. And, if you don't yet have a Blogger or Google account, there is the also familiar link to

Create an account

Clicking on "Create an account", you are given the standard Google "Create your Google Account" wizard.

As with any account creation scenario, I will once, again, remind you that creating a Blogger / Google account creates a responsibility. It is in your best interest to remember and secure the account name and password, and to religiously maintain all backup devices and features, such as backup email account, phone number, and secret question.

As with any Blogger / Google feature, use of the Google "One account" login is subject to your use of a computer with properly configured filters. You need proper filter settings, to permit popup windows, scripts (JavaScript), and third party cookies.

The Google "One account" display, when used for Following, may be subject to the same confusion, as with the Blogger login. Don't use the login account menu, without being aware of possible confusion.

The login process appears to run under "accounts.google.com", presenting cross site relationships with "blogger.com", "blogspot.com", and whatever country code domain, and / or custom domain might affect you, as you view your blog and other blogs.

Interestingly enough, once you are logged in to Following, and you prepare to Follow another blog, you still may get the choice of account hosts.

• Following (Default)
• Blogger
• Google
• Orkut
• Netlog
• Plaxo
• Twitter

The Google "One account" login only replaces the authentication portion of Following. Just click on the "More options" link, instead of the initial "Follow this blog" button, for an intriguing complement of Following options.

>> Top

The New Google Login, And Using Public / Shared Computers

I've written a few times about protecting your Blogger / Google account, when you use public / shared computers.

Generally, any concern about use of public / shared computers discusses cookies, which are simply invisible traces that you might leave behind when using any computer. If you only use your own computer - and never share your computer - this issue is probably of no concern to you.

If you use a computer that someone else, who you know, also uses, cookies are a small concern. If you use a computer that other people, who you don't know, also use - as in a public computer in a coffee shop or library - this should be a larger concern.

If you look at the Google login screen, you'll see a common option, on many login screens.

Stay signed in.

If you hover the mouse over the option, you'll see a small popup.

For your convenience, keep this checked. On shared devices, additional precautions are recommended. Learn more.

Clicking on "learn more", you get to read Securely signing in to Google.

The Google Help article mentions cookies as a significant risk to you, when using a public computer ("Devices used by lots of people").

Public computers, if well-maintained, automatically clear a user’s web history and cookies. If you’re unsure, we recommend that you use the private browsing feature of the browser. If private browsing isn’t available, clear the browser’s history, cache, and cookies before and after you use the device.

With a shared computer ("Devices shared with a few people"), the risk is less alarming.

If you only plan to use the device briefly, such as when visiting a friend or relative, we suggest using private browsing.

If you plan to use the device often (say, for example, it’s your family computer), then we suggest creating a user profile either in the operating system or in the browser so you can keep your information private from other users. We recommend you leave the "Stay signed in" checkbox selected to take advantage of Account Chooser and longer sessions. Learn how to add user profiles on an Android device or in Chrome.

And the final note.

If none of these security options are available to you, we strongly suggest you do not sign in to your Google Account. If you do sign in, we recommend deselecting the "Stay signed in" checkbox in case you forget to sign out.

I've discussed clearing cache, cookies, and sessions, in a few articles - and in more than a few forum discussions. In many cases, before the new Google Login (2014) was developed, cookies were moderately significant. Cookies, along with cache and sessions, are normal bits of data, which a knowleagable hacker might find hidden away, on a computer.

With the new Google login display, cookies are a more significant concern. Look at a typical Account Chooser login screen might look like, on a computer shared by a number of people who use Google products.

Would you want any later user of your computer, checking out Account Chooser, and finding your email address in plain view?


If you, personally, only use one Google account, and never use a public or shared computer, you may never see the Account Chooser login screen. If you do see Account Chooser, in its native state (un erased), you will see the account name ("Display Name" in Blogger) and email address of each Google account owner who has used the computer, since cookies were last cleared. Note that the screen print, shown here, has display name and email address, for each of the 5 previous users, erased.

With the Google login display (2014), and Account Chooser, we have gone from account vulnerability to any knowleagable hacker, to account vulnerability to anybody who cares to click on "Use a different account".

Obviously, when using a public computer - and probably a shared computer - you would not want to ever select "Stay signed in". Also, if you ever have to use a public computer, I would always use 2-Step Verification.

>> Top