Blog owners continue to forget the account name and / or password of their Blogger accounts, then demand alternate recovery options.
Every week, we see the reports in Blogger Help Forum: Get Help with an Issue, claiming that changing their email - or getting a new phone - caused somebody to unfairly lose access to her / his blog. Too many blog owners refuse to understand that the email address and phone number are simply backdoor accesses to their Blogger accounts.
When given advice to use Blogger: Forgot your username or password?, or Blogger Help: Having trouble signing in or viewing your blog?, we frequently see demurrer.Neither tool helps me. Can I please contact a real person?
The implication, when demanding human real time contact, is that the blog owner (or would be blog thief) can provide secret details - which when supplied, will convince a real Google security employee that the Blogger account / blog is the legal property of the complainant.
Secret details, which are jointly effective for Blogger / Google and the would be blog owner, are quite limited.
Account / blog recovery details have standards, to be useful.
Any account / blog recovery has to be based upon details which have three requirements.
- The would be owner knows, and can use.
- Blogger / Google can verify, within their own databases.
- No third person can discover, using enough search time (Google or competitor) - or manufacture, using PhotoShop or a similar product.
Any details, which do not fulfill all 3 requirements, are either useless or unsafe. If unwisely accepted by Blogger / Google, they simply allow theft of someone else's properly secured Blogger account and blogs.
Verification can only use Blogger / Google maintained details.
Verification has to be based on Blogger / Google databases. Blogger cannot accept FaceBoook, Twitter, or WordPress personal pages or profiles, as proof of identity or ownership.
Blogger has a responsibility to active blog owners, to not permit theft.
Many complainants claim that Blogger is being unfair, in denying them access to their blogs. They overlook the fact that unwisely accepting publicly known or unverifiable details, as proof of blog ownership / identity, would be unfair to the millions of blog owners, who remember their login details - and are actively maintaining and publishing their blogs.
The purpose of account recovery is not to simply allow every blog owner access to their blogs, even if they casually neglected to remember required identification tokens (account name, email address, password, etc.). The purpose is to allow as many blog owners as possible access to their blogs - while preventing malicious blog theft by hackers able to misuse the provided recovery tools.
Active blog owners want their blogs to remain theirs.
People who carefully maintain access to their accounts and blogs do so, based on the presumption that Blogger / Google will not unwisely give someone else access. These people appreciate the Blogger promise that our blogs will remain ours, forever - as long as we exercise common sense and courtesy.
The many blog owners, who maintain both front door and back door access - and actively maintain and publish their blogs - do not really care about the few who need "their" long dormant blogs recovered - or who want to delete "their" blogs, so they can move their activity to FaceBook or WordPress. They appreciate that Blogger will not give up login details, without observing appropriate caution.
Whether you give up your blog willingly, have your blog stolen from you, or accidentally enable your blog to be stolen - once your blog is in someone else's control, Blogger cannot, legally, help you.
We see the naivete, periodically, in Blogger Help Forum: Something Is Broken.I made my friend an administrator of my blog, and he changed me to an author. Can Blogger restore my ownership?
And the short answer, too frequently given, is denial.No, Blogger cannot help you.
Blogs stolen, supposedly from their rightful owner, can generally not be returned by Blogger.
There are various ways to lose control of a blog.
In any case, once control passes to another person, it's unlikely that Blogger can, unilaterally, restore ownership.
Blog thieves are very persuasive - and masquerade as theft victims.
One problem here is that too many would be blog thieves start their tales with just these claims. Long ago, Blogger Support would, obediently, "restore" ownership, when requested - and we would later see the angry forum report.
How did this other person get control of my blog?
Blogger Support would research the second "theft" report - and realise, too late, that they had previously enabled the theft.
Blog owners enable some thefts, with security mistakes and requests.
Also, if you neglect to remember your account name or password, please don't just setup a new account, then suggest that Blogger transfer control of the blog, to the new account. This suggestion, also, has been used to make Blogger an unwitting accomplice in too many thefts.
Blog owners must assume some responsibility for problems.
The bottom line here is that you have to accept full responsibility, for retaining control of your Blogger account and blogs.
Even if your friends account is hacked, then used to attack yours, don't expect assistance from Blogger / Google. And please understand that blog security review won't happen, immediately.
We see the pain, in Blogger Help Forum: Something Is Broken, of blog owners who do not understand the need for keeping the name of their Blogger account a secret.I forgot the email address that I was using. Why can't Blogger just tell me the address??
and some askHow did this unknown person "xxxxx xxxxx" get control of my blog?
Years ago, the local police would have to convince home ownersPlease, stop leaving a spare key under a rock, near the door!
Both many blog owners (today) - like some home owners (years ago) - had the same basic problem - naivete.
Like the home owners of years ago, who kept a spare key under a rock near the front door, for emergencies, blog owners will use tricks to remember their password.
Don't - please don't - use a guessable password!
One favourite technique, for remembering the password, is so obvious.
Pick a password based upon something that you can remember.
For a blog owner who is married, the answer is obvious.
What is my spouse's name?
and there's your password. If you forget that, you have worse problems, that cannot be addressed here.
If the name of one's spouse was a secret, using the name would not be a problem. But knowing that many blogs either contain the name (and picture, maybe) of the whole family - or lead to a Profile page or website (FaceBook, Instagram, Twitter, ...) with similarly useful information - how secret is the password going to be?
Hackers love blogs with guessable passwords.
Knowing both the Blogger account name (email address) that owns any blog of interest, and the URL of the blog, any hacker has a simple enough task.
- Scrape blog content, into a text analyzer.
- Extract a few hundred details (spouse's name, and others) from the blog content, as analysed.
- Run the known details through a password generation program.
- Now, the hacker has a database, containing "10,000 good possible passwords", specifically relevant to this blog.
- Go to "www.blogger.com", plug in the account name, and try out the 10,000 passwords, one by one.
- That's a simple brute force password attack.
- Sit back, and watch any botnet, controlled by the hacker, go to work.
- Given enough time, the hacker very likely gets access to the Blogger account, and to the blogs owned by the account.
Steps 1 - 8, for any experienced hacker, will be summed into one step.Plug in the URL of the blog.
Everything needed is just more coding - and a nice robust botnet or two.
The hacker, of course, will be targeting thousands of different blogs, simultaneously. So what if he (she) fails to find what details she (he) needs, to steal your blog? He'll (she'll) gladly settle for another - while the botnet works on yours.
Besides using a "strong" password (which carries it's own risks such as forgetting the password - and now we're here, again), the best way to prevent a brute force attack is by preventing step 5.
Keep the account name / email address a secret.
Additionally, if you have a blog and a business - or otherwise exchange email with strangers, separate your Blogger / Google account and your email account. Use two separate email addresses, for Blogger and email.
Learn to appreciate efforts made, by Google, keeping your account and blogs safe.
If you need to recover access to your Blogger account, don't expect to use the Blogger "Forgot?" wizard, plug in your blog URL, and get a reply
Email was sent to your address xxxxxxx@yyyyy.zzz
And, if you post in the forum.
Please email me advice, to "xxxxxxx@yyyyy.zzz"!
expect to get a stern warning
Please, do not post Blogger account names, or email addresses, in the forum.
People objecting to the recent Blogger policy of masking email addresses, in Blogger commenting and similar services, as "no-reply @ blogger . com", may also need to consider this very real issue. Possibly, even use Google+, instead of Blogger commenting, for networking with ones peers.
Google tries to identify brute force attacks, and takes action when possible.
And, if your Blogger / GMail / Google account is disabled - and you get a mysterious notice about
Suspicious / Unusual activity on your account
this could well be the other side of a brute force attack against your account, intercepted by Google.
Don't be offended by the various precautions.
If you find the precautions and problems to be unacceptable, consider using Google 2-step verification, to protect your account against brute force hacking.
This is not fiction here - it's all very real.
None of this is fiction or paranoia - it's based on some very real, recent events, and even involves a recent National Scandal - and leads to some very real conundrums.
Similarly, we have a very distasteful answer, to a seemingly worthy need. And another apparently "ceremonial" but necessary answer, to somebody in need of understanding and support, that can't be provided.
You have to make the effort, to maintain and protect your blog.
You will get no sympathy, when you complain how unsupportive Blogger is.
You have to make some effort - and remember some basic information - if you are going to maintain a Blogger blog. And, encourage your friends to keep their accounts and blogs safe.
