Recently, we've seen a few problems reports, in Blogger Help Forum: Something Is Broken, requesting return of blogs stolen from the rightful owner.
Supposedly, the "rightful" owner is the person posting the problem report. We've learned from past experiences that this may not always be the case, however.
Long ago, when a stolen blog claim was posted in the forum, we could report it to Blogger Support as a "blog theft".
In many cases, given enough patience, Blogger Engineering and Google Legal would carefully examine the blog ownership history, and eventually restore the blog to its "rightful" owner. Unfortunately, even with the most careful forensic examination, the "blog theft" claim was occasionally used by hackers, to steal other peoples blogs.
Most recently, when "blog theft" is reported, Blogger Support declines to consider the case. Considering all of the issues, we generally see that they are making a responsible business decision.
Instead of spending massive amounts of time verifying individual claims, Blogger Engineering appears to be working on overall improvements to Blogger - to encourage blog owners to not put themselves, or their accounts and blogs, in unrecoverable positions.
Any blog which contains abusive material - whether malware, porn, or spam, or illegally obtained material - can be reported using the proper complaint form. Blogs which do not contain abusive material are the property of the current owner - and Blogger / Google will respect and support the current owner.
Blog owners, claiming theft, can generally report a stolen blog as abusive - if the current content justifies that claim. Other than that, the best solution is to hire a lawyer and convince a judge to issue a court order - and require Google Legal to become involved.
The issue of Blogger account and blog recovery is a long and painful one - for many people.
>> Top
Showing posts with label Authentication Confusion. Show all posts
Showing posts with label Authentication Confusion. Show all posts
Friday, 2 August 2013
Tuesday, 23 July 2013
Anonymous Blog Ownership, And Hacked Account Detection
This week, we're seeing a number of reports from blog owners with Blogger accounts recently hacked.
With hacked Blogger / Google accounts, causing deleted blogs, there's not a lot of advice that we can provide.
We're also seeing the normal amount of reports of blogs deleted by Blogger, when detected for malware, porn, or spam. In some cases, blog review ends with the conclusion that the blog was not, in fact, deleted for a TOS violation. In these cases, the blog won't be restored by Blogger Support.
In some cases, blog review - which starts with a claim of spurious classification for malware, porn, or spam hosting - ends with advice to have the owning Blogger / Google account recovered.
The blog owner has to wait until the review process is complete, to learn where he should have started, days ago. As I've observed a few times in the past, anonymity - whether intention or accidental - can cause problems with blog ownership. If your Blogger / Google account is locked, but you don't get the required notification, you can waste valuable time with the blog offline.
Whether you intentionally anonymise yourself - or accidentally create a second (or third) Blogger account, you may not get essential email from Google, advising you to recover your account. When that happens, your blog will stay offline until it can be reviewed - and review starts only after you recover the account that was locked.
Now, you're going to have to open every possible email account, and carefully look for the overlooked email. If you never find the missing email message, you're going to have to login to Blogger, using every possible email address that you may have ever used, until you hit the locked Blogger account.
When you do identify the locked account, you'll get the advice to change your password, solve a CAPTCHA, and / or answer a number of secret questions, to prove that you are the account owner. Or, if you're lucky, you can await a phone call (digital or voice) with a special code, to unlock your account. Either way, you'll be unlocking the account while under stress, with the blog offline.
And after you get the account unlocked, you'll still have to wait until the blog(s) can be verified.
If you try to blame Google, for this disaster
>> Top
I was asked to change my password, because of suspicious activity. Having done that, my blogs are now deleted!
With hacked Blogger / Google accounts, causing deleted blogs, there's not a lot of advice that we can provide.
As you just discovered, the account is recovered almost immediately. Blog recovery, unfortunately, takes longer - sometimes, 1 to 2 days. You'll have to wait, patiently, until your blogs are verified by Google Security staff.
We're also seeing the normal amount of reports of blogs deleted by Blogger, when detected for malware, porn, or spam. In some cases, blog review ends with the conclusion that the blog was not, in fact, deleted for a TOS violation. In these cases, the blog won't be restored by Blogger Support.
In some cases, blog review - which starts with a claim of spurious classification for malware, porn, or spam hosting - ends with advice to have the owning Blogger / Google account recovered.
The blog owner has to wait until the review process is complete, to learn where he should have started, days ago. As I've observed a few times in the past, anonymity - whether intention or accidental - can cause problems with blog ownership. If your Blogger / Google account is locked, but you don't get the required notification, you can waste valuable time with the blog offline.
Whether you intentionally anonymise yourself - or accidentally create a second (or third) Blogger account, you may not get essential email from Google, advising you to recover your account. When that happens, your blog will stay offline until it can be reviewed - and review starts only after you recover the account that was locked.
Now, you're going to have to open every possible email account, and carefully look for the overlooked email. If you never find the missing email message, you're going to have to login to Blogger, using every possible email address that you may have ever used, until you hit the locked Blogger account.
When you do identify the locked account, you'll get the advice to change your password, solve a CAPTCHA, and / or answer a number of secret questions, to prove that you are the account owner. Or, if you're lucky, you can await a phone call (digital or voice) with a special code, to unlock your account. Either way, you'll be unlocking the account while under stress, with the blog offline.
And after you get the account unlocked, you'll still have to wait until the blog(s) can be verified.
If you try to blame Google, for this disaster
Why was my blog deleted? I did not spam!you will simply be wasting your time. This is yet one more story that starts with gratuitous and uncontrolled creation of multiple Blogger accounts and email addresses.
>> Top
Wednesday, 29 May 2013
The Google Apps "bloggeradmin" Password Reset May Be Broken, For Some Domains
We've been seeing reports from some frustrated blog owners, about problems with the limited access Google Apps accounts.
Even given the recently provided "bloggeradmin" username, and the standard Google account reset process, some blog owners still cannot access Google Apps to manage their Blogger custom domain published blogs.
We do have one bit of hope. One such problem report, recently forwarded to Google Apps Support, was noted by a Google Apps Engineer with the advice
So, there is some hope for a few unhappy new domain owners. It's possible that this problem has been resolved, with Google Apps now using the new comprehensive Google login screen.
>> Top
I've reset my password numerous times and it still doesn't work.
Even given the recently provided "bloggeradmin" username, and the standard Google account reset process, some blog owners still cannot access Google Apps to manage their Blogger custom domain published blogs.
We do have one bit of hope. One such problem report, recently forwarded to Google Apps Support, was noted by a Google Apps Engineer with the advice
We identified a recent change which may have affected the password reset flow for some users. We expect it to either be fixed or rolled out shortly.
So, there is some hope for a few unhappy new domain owners. It's possible that this problem has been resolved, with Google Apps now using the new comprehensive Google login screen.
>> Top
Tuesday, 14 May 2013
The Google Apps "bloggeradmin" Password Reset Uses A Standard Google Account Reset
As Google Apps updates their limited function ("bloggeradmin") account setup process, we see reports from confused Blogger blog owners.
The Google Apps password reset uses a standard Google account reset process - and is subject to normal account reset behaviour. If you don't reset the right account, you won't be able to login, later.
We've been warning people for years, about the need to use two browsers, to transfer a Blogger blog from one Google (GMail) account to another.
The Google Apps "bloggeradmin" account setup, like the Blogger blog transfer, works best using two browsers. The password reset, for "bloggeradmin@mydomain.com" (as an example, here) involves a Google account reset.
When you attempt to login to Google Apps, click on "Can't access your account?". That takes you into the Google Account Reset process.
Provide the full account name of your Apps account.
The Google Apps password reset, like blog account transfer, is one more process where you may need to use two different browsers. And, to be safe, clear cache, cookies, and sessions (yes, all 3!) - then restart the second browser, before opening the password reset email.
The password reset will be more likely to be successful, if your Blogger account is based on an active and real email address - this is not a good time to be anonymous.
(Update 2013/11/03): This process should be slightly simplified, with Google Apps now using the new Google comprehensive login screen.
>> Top
After I reset my password, I still getandThe username or password you entered is incorrectwhen I try to login, later!
I reset my password - and it changed my Blogger and GMail account - but I still can't login to Google Apps!!
The Google Apps password reset uses a standard Google account reset process - and is subject to normal account reset behaviour. If you don't reset the right account, you won't be able to login, later.
We've been warning people for years, about the need to use two browsers, to transfer a Blogger blog from one Google (GMail) account to another.
The Google Apps "bloggeradmin" account setup, like the Blogger blog transfer, works best using two browsers. The password reset, for "bloggeradmin@mydomain.com" (as an example, here) involves a Google account reset.
- You start the password reset from a Google Apps login screen, for "mydomain.com".
- After clicking on the "Can't access your account?" link, you use a standard Google account reset process.
When you attempt to login to Google Apps, click on "Can't access your account?". That takes you into the Google Account Reset process.
Provide the full account name of your Apps account.
bloggeradmin@mydomain.cominstead of
myemail@gmail.com
The Google Apps password reset, like blog account transfer, is one more process where you may need to use two different browsers. And, to be safe, clear cache, cookies, and sessions (yes, all 3!) - then restart the second browser, before opening the password reset email.
The password reset will be more likely to be successful, if your Blogger account is based on an active and real email address - this is not a good time to be anonymous.
(Update 2013/11/03): This process should be slightly simplified, with Google Apps now using the new Google comprehensive login screen.
>> Top
Sunday, 21 April 2013
Recovering And Protecting Your GMail Account
Blogger blog owners may have productive action, when their Blogger accounts are successfully hacked through an attack on their GMail accounts.
GMail account owners can get detailed instructions on recovering a successfully hacked account, and on preventing future hacking attacks from being successful. Some of the instructions are specific to GMail use - but overall, Blogger account owners will benefit from their use.
To benefit from the GMail instructions, one should consider the differences between Blogger, email, and Google accounts.
Gmail Account Recovery: Gmail Account Recovery and Security provides complete and detailed instructions for recovering a hacked and stolen GMail email account.
The Recovery instructions include specific mentions of Disabled / Suspended accounts, successfully Stolen accounts, and accounts locked or deleted because of Underage owners.
Accompanying the recovery advice is Gmail help and information: How NOT To Get Hacked. These are instructions for preventing a recurrence of a reported problem. This includes discussion of using a strong and secure password, identifying hacking techniques that involve the account owner, and preventing attacks which are conducted using the computer or network in use by the account owner.
The Prevention instructions, many which are common sense issues to any IT professional or security expert, are specifically written to apply to GMail account owners. There may be additional issues which apply in general, to Blogger accounts - and specifically, to Blogger accounts which are based on non GMail email accounts.
There are a few differences between Blogger blog ownership and GMail account ownership, which will cause issues that cannot be easily resolved by Blogger Support, or by GMail Support, to the satisfaction of the (former) blog owner.
GMail accounts are, by nature, single owner - and ownership of a GMail account is never transferred. In contrast, Blogger blogs can be under team ownership - and ownership can be transferred.
Though maybe not preferred by the (former) blog owner, the blog in question will now be under control of another person. It's possible that some of these scenarios are considered by Google Security, when reviewing Blogger / Google accounts after hacking activity is detected.
Blogger accounts, based on non GMail email addresses, will be subject to the typical uncertainty which accompanies any third party service in Blogger. Some details may be involve the email provider, while others will involve Blogger - and arbitrating between the two will be the responsibility of the Blogger account owner.
Owners of Blogger accounts which are based on non GMail email addresses will need to contact the providers of the actual email service, for resolution of some of these issues.
In general though, the GMail Account Loss Prevention and Recovery instructions provide good advice, for any Blogger account owner.
>> Top
GMail account owners can get detailed instructions on recovering a successfully hacked account, and on preventing future hacking attacks from being successful. Some of the instructions are specific to GMail use - but overall, Blogger account owners will benefit from their use.
To benefit from the GMail instructions, one should consider the differences between Blogger, email, and Google accounts.
Gmail Account Recovery: Gmail Account Recovery and Security provides complete and detailed instructions for recovering a hacked and stolen GMail email account.
The Recovery instructions include specific mentions of Disabled / Suspended accounts, successfully Stolen accounts, and accounts locked or deleted because of Underage owners.
Accompanying the recovery advice is Gmail help and information: How NOT To Get Hacked. These are instructions for preventing a recurrence of a reported problem. This includes discussion of using a strong and secure password, identifying hacking techniques that involve the account owner, and preventing attacks which are conducted using the computer or network in use by the account owner.
The Prevention instructions, many which are common sense issues to any IT professional or security expert, are specifically written to apply to GMail account owners. There may be additional issues which apply in general, to Blogger accounts - and specifically, to Blogger accounts which are based on non GMail email accounts.
There are a few differences between Blogger blog ownership and GMail account ownership, which will cause issues that cannot be easily resolved by Blogger Support, or by GMail Support, to the satisfaction of the (former) blog owner.
GMail accounts are, by nature, single owner - and ownership of a GMail account is never transferred. In contrast, Blogger blogs can be under team ownership - and ownership can be transferred.
- Intentional team blog ownership. Team blog ownership can cause problems with loss of blog control, when all known blog administrators (accidentally or intentionally) remove themselves as administrators, leaving an unknown administrator.
- Intentional transfer of control. A blog owner may assign administrator status to another person, voluntarily - then later regret his decision.
- Un intentional transfer of control. A blog owner may assign administrator status to another person, voluntarily - and the other person may then remove the former owner administrator status.
- Ownership theft after account hacking. A hacker, having temporarily gained control of a Blogger account, may transfer ownership of a blog to another Blogger account.
Though maybe not preferred by the (former) blog owner, the blog in question will now be under control of another person. It's possible that some of these scenarios are considered by Google Security, when reviewing Blogger / Google accounts after hacking activity is detected.
Blogger accounts, based on non GMail email addresses, will be subject to the typical uncertainty which accompanies any third party service in Blogger. Some details may be involve the email provider, while others will involve Blogger - and arbitrating between the two will be the responsibility of the Blogger account owner.
Owners of Blogger accounts which are based on non GMail email addresses will need to contact the providers of the actual email service, for resolution of some of these issues.
In general though, the GMail Account Loss Prevention and Recovery instructions provide good advice, for any Blogger account owner.
>> Top
Sunday, 10 March 2013
Blog Owners, Unable To Request Restore Of A Deleted Blog
One of the more intriguing issues, seen in Blogger Help Forum: Something Is Broken, involves people unable to recover control of their blogs.
Occasionally, this issue becomes more complicated, because the blog is deleted - and the owner can't request that it be restored, using the automated review request wizard. Sometimes, the would be blog owner may to try to bypass the current blog recovery policy, by claiming special circumstances.
What is the story here? Can blogs just disappear from the Blogosphere, without the involvement of the blog owners - and be unrecoverable?
Recovery of a deleted blog starts with the requirement that only a blog owner can un delete a deleted blog - and this is where many mysterious disappearances start.
Since a Blogger blog is the property of the owner, and the owner is allowed to delete a blog any time required, it would not be right to let people who are not the owner un delete a blog - or demand that the blog be un deleted. To enforce this requirement, Blogger added the dashboard based Restore wizard.
Since only the owner will have the deleted blog listed in their dashboard "Deleted Blogs" list, only the owner can request restore of the blog in question.
The dashboard Restore wizard serves blog owners, with blogs deleted under various circumstances.
There are specific cases where a deleted blog may not be recoverable using the recovery wizard.
A blog locked, pending integrity check, cannot be requested for restore. The owner has to first have the owning account unlocked. Similar to the account recovery process, Blogger / Google will require that the owner provide proof of ownership, before the account will be unlocked. With the account unlocked, security specialists will inspect each blog owned by the account, and verify that each does not contain evidence of tampering by a temporarily successful hacker.
While a blog is under integrity check, it won't be listed on the dashboard of the owner - either under "Deleted blogs", "Locked blogs", or "My blogs". Neither the owner, nor any third parties, will be able to do anything except wait, patiently.
Blogs found to contain malware can be locked as TOS Violations, with the owner later required to remove the malware found. This requirement will apply for malware installed by the owner (intentionally, or unintentionally), or for malware installed by a hacker.
With a blog locked pending malware removal, the owner is given the benefit of the doubt, and allowed to simply remove the malware, no questions asked. In some cases, Blogger may be able to assist by providing specific identification of the malware found - but this won't happen, consistently.
A blog owned under another account must be un deleted by the owner of the other account. Again, only a blog owner can have a blog restored - whether deleted by an owner, or by Blogger / Google.
A blog deleted over 90 days previously cannot be recovered. It won't appear on the dashboard of any (former) owner, since it can't be recovered.
The basic rule is simple. If your blog was deleted, and if you're able to un delete it (or request un deletion), you'll have a link on your dashboard. If a blog is not listed on your dashboard, you can't request, with any predictable success, that it be un deleted - any more than you can demand that a non deleted blog be restored to your control.
>> Top
I recently changed ISPs, and now I can't login to update my blog.
Occasionally, this issue becomes more complicated, because the blog is deleted - and the owner can't request that it be restored, using the automated review request wizard. Sometimes, the would be blog owner may to try to bypass the current blog recovery policy, by claiming special circumstances.
The blog has been deleted. I received no suspicious activity or password change notification emails, or emails of any kind related to my blog.
What is the story here? Can blogs just disappear from the Blogosphere, without the involvement of the blog owners - and be unrecoverable?
Recovery of a deleted blog starts with the requirement that only a blog owner can un delete a deleted blog - and this is where many mysterious disappearances start.
Since a Blogger blog is the property of the owner, and the owner is allowed to delete a blog any time required, it would not be right to let people who are not the owner un delete a blog - or demand that the blog be un deleted. To enforce this requirement, Blogger added the dashboard based Restore wizard.
Since only the owner will have the deleted blog listed in their dashboard "Deleted Blogs" list, only the owner can request restore of the blog in question.
The dashboard Restore wizard serves blog owners, with blogs deleted under various circumstances.
- Deleted by the owner.
- Deleted by Blogger, as a suspected spam host.
- Deleted by Google, for TOS Violation.
There are specific cases where a deleted blog may not be recoverable using the recovery wizard.
- The blog is locked, pending integrity check (following account lock for suspicious activity).
- The blog is owned under a different Blogger account, and is listed on another dashboard, under "Deleted blogs".
- A blog owner deleted the blog, long ago - and the blog is no longer recoverable.
A blog locked, pending integrity check, cannot be requested for restore. The owner has to first have the owning account unlocked. Similar to the account recovery process, Blogger / Google will require that the owner provide proof of ownership, before the account will be unlocked. With the account unlocked, security specialists will inspect each blog owned by the account, and verify that each does not contain evidence of tampering by a temporarily successful hacker.
While a blog is under integrity check, it won't be listed on the dashboard of the owner - either under "Deleted blogs", "Locked blogs", or "My blogs". Neither the owner, nor any third parties, will be able to do anything except wait, patiently.
Blogs found to contain malware can be locked as TOS Violations, with the owner later required to remove the malware found. This requirement will apply for malware installed by the owner (intentionally, or unintentionally), or for malware installed by a hacker.
With a blog locked pending malware removal, the owner is given the benefit of the doubt, and allowed to simply remove the malware, no questions asked. In some cases, Blogger may be able to assist by providing specific identification of the malware found - but this won't happen, consistently.
A blog owned under another account must be un deleted by the owner of the other account. Again, only a blog owner can have a blog restored - whether deleted by an owner, or by Blogger / Google.
A blog deleted over 90 days previously cannot be recovered. It won't appear on the dashboard of any (former) owner, since it can't be recovered.
It's dead, Jim.
The basic rule is simple. If your blog was deleted, and if you're able to un delete it (or request un deletion), you'll have a link on your dashboard. If a blog is not listed on your dashboard, you can't request, with any predictable success, that it be un deleted - any more than you can demand that a non deleted blog be restored to your control.
>> Top
Friday, 6 July 2012
Blog Control And URL Availability Hacking - Four Sides Of The Same Story
Occasionally, in Blogger Help Forum: How Do I?, we see various queries about our blogs, and how to gain or regain control.
Many blog or URL hacking attempts start quite innocently. Two of the more common ones are quite naive, and completely separate, tales.
Some people, denied recovery of the blog, because they can't prove ownership, will try another tactic.
It requires the wisdom of Solomon - and the patient persistence of Gil Grissom - to sort through the problems reports. Claims
Unfortunately, these stories - and others like them - are not always what they seem. What we sometimes see are the other side of the story.
So, if you beg and plead for attention
The bottom line here is that, if you intend to publish a Blogger blog, it is your responsibility - and only your responsibility - to maintain control of your blog. You are an adult (or are presumed to be one) - and you have responsibilities, as an adult.
>> Top
- How do I get a blog, which is attacking me (impersonating me, insulting me, publishing my secrets), removed from Blogger?
- How do I claim a dormant URL?
- How do I recover control of my blog?
- My blog is now under somebody else's control! How do I get my blog back?
Many blog or URL hacking attempts start quite innocently. Two of the more common ones are quite naive, and completely separate, tales.
- Some people want to recover control of their blog, after having forgotten the username / password.
- Other people want to start a blog - but find that the desired URL is not available.
Some people, denied recovery of the blog, because they can't prove ownership, will try another tactic.
I'll tell them that the blog was stolen from me. Surely if they think the blog was hacked, I can get it back, since I used to be the owner!People trying to gain control of a dormant blog will likewise use their imagination.
If I get the blog deleted as spam, I can grab the URL. Surely a Dormant blog is just another type of Spam, in Blogger!Unfortunately, these techniques have been used, already - and have resulted in still other tales of anguish.
It requires the wisdom of Solomon - and the patient persistence of Gil Grissom - to sort through the problems reports. Claims
I just graduated from college, and I can't use my email address to recover the password!and
I just woke up from a 7 year coma, to find my family blog under control of a hacker!and let us not overlook
My friend just died. Can I please have control of the blog, so I can put a notice to all of his friends, on the blog?and
I never updated my Blogger only account to a Blogger / Google account - and I never got any email, warning me of the impending change!All of these tales have enormous human interest - and seem to justify mercy for the plaintive requests.
Unfortunately, these stories - and others like them - are not always what they seem. What we sometimes see are the other side of the story.
- Attempts to steal control of an active blog.
- Attempts to gain control of the URL which would be perfect for their new blog, if only the URL was available.
- Attempts to probe and reveal the identity of a blog owner, who is guaranteed anonymous blog ownership, by Blogger policy.
So, if you beg and plead for attention
None of these tools help me, in the least. Can I please speak to a live human, so I can explain my special need?Please, do not be surprised to be directed to read about why Blogger Help is the only contact, and why you absolutely must prove ownership of the blog, before being given control. And even the ultimate insult, you must provide a copy of the death certificate plus get a court order, as you grieve for the loss of your friend or loved one.
The bottom line here is that, if you intend to publish a Blogger blog, it is your responsibility - and only your responsibility - to maintain control of your blog. You are an adult (or are presumed to be one) - and you have responsibilities, as an adult.
>> Top
Monday, 25 June 2012
Attention June 2012 Graduates: Transfer Ownership Of Your Blogger Blogs, Now
As you pack up your personal belongings, and close down your various student activities related to your college / university life, you're probably spending some time creating various traces, to point to your new life, which is now starting. One such activity would involve filing various "change of address" notifications, for people / services who communicate with you through postal mail, addressed to the college postal address which you use.
Similar to postal mail, you probably have a college email address, issued to you when you registered as a student. Hopefully by now, you have setup a non college email account, and are busy filling out change of address "notifications" for the many services which communicate with you through email. As you do this, you should think of your Blogger account, which owns your Blogger blogs.
Before you lose access to your Blogger account that's based on your college email account, setup a new Blogger account, based on your new non college email address. Then, transfer control of your blog(s), to your new Blogger account.
Don't delay - do this now - before you end up asking for help that can't be provided.
>> Top
Similar to postal mail, you probably have a college email address, issued to you when you registered as a student. Hopefully by now, you have setup a non college email account, and are busy filling out change of address "notifications" for the many services which communicate with you through email. As you do this, you should think of your Blogger account, which owns your Blogger blogs.
Before you lose access to your Blogger account that's based on your college email account, setup a new Blogger account, based on your new non college email address. Then, transfer control of your blog(s), to your new Blogger account.
Don't delay - do this now - before you end up asking for help that can't be provided.
>> Top
Subscribe to:
Posts (Atom)
