Recently, we've noted a number of complaints about Blogger commenting, in Blogger Help Forum: Something Is Broken.My comments all use a "noreply" email address, instead of my actual email address. How do I have people email their replies to my comments?
This appears to be one more way which Blogger is trying to safeguard our Blogger accounts and blogs, from malicious, technically astute blog thieves.
Some time ago, we observed that this precaution appeared to be unique to Blogger accounts which used Google and Google+ profiles - and did not involve Blogger profiles.
It appears that this is now universal, and includes Blogger profiles, as well as Google / Google+ profiles. It's likely that the noreply email addresses are being offered to keep more blog readers from, inadvertently, exposing their email addresses to email mining techniques.
In remembering the long ago discovered "nice blog" spam, it's possible that "nice blog" spam was originally developed to help the spammers gather email addresses, using very innovative technique.
All that a spammer has to do is to post a "nice blog" comment, select "Email follow-up comments to me" - then watch as the Inbox fills up with follow up comments from bloggers, willingly giving up their email addresses to every stranger also selecting "Email follow-up comments to me", in that comment thread.
The people willingly providing their email addresses, to the world in general, are perfect targets for hackers later trying to brute force access to the Blogger accounts, starting from the provided email addresses. Use of the "no-reply" email address prevents this type of mischief - and reduces the workload of Google Security, as they would otherwise have to verify account / blog integrity, for hacked accounts and blogs.
For even more protection (which is not a bad idea, in any case), consider using Google 2-Step Verification, to protect your Blogger / Google account from hacking.
>> Top
Blog owners continue to forget the account name and / or password of their Blogger accounts, then demand alternate recovery options.
Every week, we see the reports in Blogger Help Forum: Get Help with an Issue, claiming that changing their email - or getting a new phone - caused somebody to unfairly lose access to her / his blog. Too many blog owners refuse to understand that the email address and phone number are simply backdoor accesses to their Blogger accounts.
When given advice to use Blogger: Forgot your username or password?, or Blogger Help: Having trouble signing in or viewing your blog?, we frequently see demurrer.Neither tool helps me. Can I please contact a real person?
The implication, when demanding human real time contact, is that the blog owner (or would be blog thief) can provide secret details - which when supplied, will convince a real Google security employee that the Blogger account / blog is the legal property of the complainant.
Secret details, which are jointly effective for Blogger / Google and the would be blog owner, are quite limited.
Account / blog recovery details have standards, to be useful.
Any account / blog recovery has to be based upon details which have three requirements.
- The would be owner knows, and can use.
- Blogger / Google can verify, within their own databases.
- No third person can discover, using enough search time (Google or competitor) - or manufacture, using PhotoShop or a similar product.
Any details, which do not fulfill all 3 requirements, are either useless or unsafe. If unwisely accepted by Blogger / Google, they simply allow theft of someone else's properly secured Blogger account and blogs.
Verification can only use Blogger / Google maintained details.
Verification has to be based on Blogger / Google databases. Blogger cannot accept FaceBoook, Twitter, or WordPress personal pages or profiles, as proof of identity or ownership.
Blogger has a responsibility to active blog owners, to not permit theft.
Many complainants claim that Blogger is being unfair, in denying them access to their blogs. They overlook the fact that unwisely accepting publicly known or unverifiable details, as proof of blog ownership / identity, would be unfair to the millions of blog owners, who remember their login details - and are actively maintaining and publishing their blogs.
The purpose of account recovery is not to simply allow every blog owner access to their blogs, even if they casually neglected to remember required identification tokens (account name, email address, password, etc.). The purpose is to allow as many blog owners as possible access to their blogs - while preventing malicious blog theft by hackers able to misuse the provided recovery tools.
Active blog owners want their blogs to remain theirs.
People who carefully maintain access to their accounts and blogs do so, based on the presumption that Blogger / Google will not unwisely give someone else access. These people appreciate the Blogger promise that our blogs will remain ours, forever - as long as we exercise common sense and courtesy.
The many blog owners, who maintain both front door and back door access - and actively maintain and publish their blogs - do not really care about the few who need "their" long dormant blogs recovered - or who want to delete "their" blogs, so they can move their activity to FaceBook or WordPress. They appreciate that Blogger will not give up login details, without observing appropriate caution.
Since 2009, I've been explaining the intricate relationships between Blogger accounts, email addresses, and Google accounts.
One of the challenges of logging in to Blogger or Google involves account names and passwords, that may be shared with an email account that is the basis for the Blogger / Google account name.
Non GMail based Blogger / Google accounts initially share an account name / email address with the source non GMail email account. If you change a non GMail email address, the Blogger account name will not change. If you delete a non GMail account, the Blogger account is not deleted. Finally, even with shared account names, the passwords between the email account, and the Blogger / Google account, are not automatically shared.
With a GMail / Google based Blogger account, on the other hand, both the account name and password will be shared - since it's the same account. If you delete a GMail / Google Blogger account, the Blogger account - and all owned blogs - are also deleted.
Besides the account name / password confusion, use of the Google login wizard is complicated by use of Google Apps based email accounts.
Use of the new Google login wizard is a challenge because of the blind login process - and the lack of detailed diagnostics, when an incorrect account name or password is entered. The lack of detailed diagnostics helps prevent hacking of our Google accounts, when our email address and various personal details become known to the public. Any mistakes result in one monolithic error.The email or password you entered is incorrect.
Google Apps based email accounts are a frequent concern, when frustrated custom domain owners need to access their Google Apps accounts, to either update domain registration payment details, or to access the registrars domain management dashboard.
Google Apps access, which uses the Google multi-account login wizard, is complicated by domain owners who do not realise (or remember) the non GMail based Google Apps account name - or the password.
Before Google Apps based email domains became an issue, it was possible to easily identify non GMail based Blogger / Google accounts, as opposed to GMail based accounts, based on one significant detail - the absence of "gmail.com" / "googlemail.com" in the account name.
Observing that a given Blogger account name did not include "gmail.com" / "googlemail.com", we could advise a Blogger account owner of the issues involving account name / password sharing, between the source email account, and the Blogger / Google account.
Thanks to the existence of Google Apps based email domains, it is now possible to have GMail / Google accounts which lack the "gmail.com" / "googlemail.com" in the account name - and we see the confusion.
- Some blog owners may delete an unused "non GMail" Google account, not realising that they are deleting the necessary Blogger / Google account that owns a given blog.
- Other blog owners may be unable to use the Google login wizard effectively, since they don't understand that a non "GMail.com" account may be a Google account.
- And, in truly unfortunate scenarios, we have blog owners who lose control of their blogs when their employer, Internet Service Provider, or school converts their domain to use Google apps management
Just as it's impossible to canonically identify "legacy" accounts, it's a challenge to adequately describe the issues specific to Google Apps based non "GMail.com" Blogger / Google accounts. Control and synchronisation issues, relevant to both the account names and passwords, will always cause confusion, to Blogger blog owners.
Articles about regaining account control - and proper use of the new Google One Login wizard - will be referenced frequently, in Blogger Help Forum: Something Is Broken.
>> Top
Ever since Blogger started using Google accounts to authenticate Blogger account access, blog owners have had trouble maintaining access to their accounts and their blogs.
Not all Blogger blog owners understand - and less accept - the measures that Blogger has taken, to prevent malicious activity, by unknown persons who would use Internet obscurity to hijack their accounts, and their blogs.
Every day, we see numerous complaints in Blogger Help Forum: How Do I?, about inability to recover account access. And, we see occasional (not occasional enough) reports about blogs now owned by people who are not personally known by the rightful blog owner.
Blogger is continually improving their account recovery, authentication, and account hijack prevention policies. Unfortunately, as they improve in one area, they make things more difficult in another.
Until late 2010, Blogger / Google offered several options, for recovering account / blog access.- An automated wizard, where you could provide the URL of your blog, and have account recovery instructions sent to the email address registered with the Blogger account(s) that administered the blog, accompanied by the welcomed advice
We've sent password reset instructions to your email account xxxxxxx@yyyyy.zzz.
- An option, should the latter email account be unusable (the owner graduated from school, changed ISPs, changed jobs), to walk into many regional Google offices, present proof of identity, and regain access to some Blogger accounts.
- In some limited cases, to transmit a facsimile of specific proof of identity documents to a Google office, have identity verified remotely, and regain access to some Blogger accounts.
In early 2011, we noted a significant number of cases where people were reporting logging in to Blogger, and finding various personal blogs missing from the dashboard blog lists. Checking the blogs themselves, they were found to be still online - but now owned by other persons. In an alarming number of cases, the persons then owning the mysterious blogs appeared to be part of a malicious and well planned attack, against Blogger accounts and blogs.
In mid 2011, Blogger changed the automated account recovery wizard, to not display the email address being used for the password recovery. Now, we see less detail.We've sent login instructions to your GMail account.
or evenWe've sent login instructions to your account at y****.com.
To recover account access, the blog owner is now required to remember the email address - or minimally, to have access to all owned email accounts, and check each account, one by one, until login instructions are found.
To reduce the need for local and remote identity verification, Google enhanced the account recovery wizard, where the blog owner can provide an email address (whether or not usable for incoming email), provide secondary details to prove identity, and regain access. They also added Two Step Verification, which lets you use a pre registered cell or home phone, as an additional / alternate identity token - both to prevent hijackings, and to recover account access.
Unfortunately, people who idly forget the password and the email address, or who forget (or never provide) secondary personal details when setting up their Google account, will always be a challenge. Another challenge is provided by people who value anonymity, and setup multiple email accounts to obscure their real life identity from their Blogger blog ownership.
In specific cases, Blogger is known to provide mysterious "hints" to people who have gratuitously used multiple email accounts - and who cannot now remember all accounts used.Your email address is a***0@yahoo.com.
However, the limited effectiveness of hints should always be noted. The Blogger Help Forum: [FAQ] Regarding account-related issues won't be going away, for lack of traffic, any time soon.
>> Top
In terms of Blogger problems, which occur seemingly randomly and have no obvious user solution, I can't think of too many that bring more dread into peoples hearts than
403 Forbidden
That message is actually where I started this blog - many, many years ago. It's come up, in discussion, several times.
The message "403 Forbidden" is literally a response by a computer somewhere, saying that you are not permitted to access this computer. For Blogger / Google customers, it generally has a slightly different origin.
The "403 Forbidden" message, for Blogger blog owners, is frequently the result of a networking technique, used by Google and owners of other large networks, for blocking suspicious network traffic.
"403 Forbidden" refers to suspicious network traffic, maybe from a bot cluster.
It generally means that some group of computers, in your ISPs address space, are controlled by somebody besides their legal owners - and are generating excessive network traffic which the Google networks are detecting as suspicious. The "suspicious activity" may involve brute force password guessing, or botnet driven new blog setup activity, or maybe excessive relaying of referer spam.
Some other Blogger account owner(s), somewhere else in the world, may be seeing a "Disabled account" notice, referring to "suspicious activity on your account", or maybe odd links to pornographic websites, from the Stats logs.
Google initially blocks the general address space, to examine the problem.
In order to continue service to the world in general, Google will block the problem computers, from access to their networks. If the Internet address used by your computer is similar to the addresses used by the problem computers, Google will block your computer, along with the other computers (your neighbours computers).
You may have to wait this problem out, as Google researches it.
If this happens to you, there's probably nothing that you can do but wait this out. One or more things will happen, eventually.
- Other Google users will report the symptom - or validate their identity - and Google will research the problem.
- Google will research the problem, reduce the range of addresses blocked, and remove the block on your specific address space.
- The computers involved will go offline, or otherwise cease their attacks, and Google will remove the network block.
If you know how to, and if your Internet service allows you to do this, you may be able to change your Internet address. This solution won't be universally effective, though.
- Your Internet service ("Fixed IP") may not allow this.
- You may not know how to do this.
- Your Internet service may detect this change, by you, as suspicious activity.
- Your new address may also be blocked by Google, because of activity by another set of problem computers.
- Your new address may be blocked by another Internet service, and you'll have to start over with them.
So right now, I'll not go into the details of changing your address - though you may try doing this, if you wish. It's your computer, after all.
