Blog Security Review Is Not Instantaneous

Blog owners do not always understand the reasons behind the mysterious blog security check (following "suspicious" / "unusual" activity account lock).

We see periodic complaints about deleted blogs and locked accounts - and the inconvenience involved, in Blogger Help Forum: Get Help with an Issue.

I get the security and all - but I don't get how a blog is just deleted.

This blog owner, like so many, does not understand how Blogger is trying to keep our blogs under our control - even after detection of "suspicious" / "unusual" activity.

Blog security check, if immediate and instantaneous, would not be noticed.

Blog security check is an art - not a science - and it takes time.

If blogs could be checked for hacking interference without delay, most owners would not complain. Unfortunately, examining blogs for hacking interference requires intense study - and most security experts do not work on weekends.

One unfortunate issue, about all of this, is that not all "suspicious" / "unusual" activity is malicious. Some of it is a simple result of people unable to use account / blog recovery - being innocently told to try every account name and password that can be remembered.

Owner delay, in requesting account unlock, contributes to security check delay.

In some cases, the locked account / deleted blogs may not be immediately discovered by the owner - and this may lengthen the security check process.

Not all blog owners publish - or even read - their blogs regularly. Nor do they accept the need to intentionally keep their account and blogs under their control.

Some owners are very casual about blog security - until a blog is successfully stolen.

---

Some #Blogger blog owners are not terribly impressed by the need to keep their blogs under their control, until a blog is stolen. The measures taken by Blogger / Google Security staff are considered mere annoyances.

Read More

Please, Don't Try Guessing Your Account / Password!

We see too many problem reports, in Blogger Help Forum: Get Help with an Issue, about locked accounts and deleted blogs.

My Google account was suspended because of 'suspicious activities'. Last month, I realized that my two connected blogs, to that account, were also put offline!

Somebody else was unable to use the supplied account / blog recovery tools - and tried guessing what could not be remembered.

The first would be a blog owner, whose only mistake was having a Blogger account with a name similar to another account, owned by the second.

The second would be someone who could not remember her (his) account name / password, could not use account or password recovery, and who got well meaning advice.

Just do the best you can - try what may be your account name, and any passwords that you can remember!

One blog owner must suffer, because another cannot remember login details.

And owner #1 is suffering, because of owner #2. Owner #1 is now anxiously waiting for action by the security experts (with the blind queue of unknown length) to examine his blogs - and possibly, waiting while not knowing why.

Owner #1 may be seeing this - and not know why.



Password guessing may be necessary, in extreme cases - but it can cause misery - and owner #2 will never realise the pain caused to owner #1. Even if owner #2 recovers access to her / his blogs, innocent brute force attempts can cause account lock / blog security lock, to owner #1.

Protect yourself against the anguish, using Google 2-Step Verification.

The best way to protect against this sort of abuse is to use one or more Google Two Step Verification options. This will leave owner #2 seeing (for instance).

Insert your USB security key, and tap the lighted button.

And having no security key, owner #2 will simply have to try guessing a different account name. It may be an inconvenience (for owner #1), carrying a never used USB security key - but the one time it's needed (and available), it will make up for the inconvenience.

---

One #Blogger blog owner, unable to remember a necessary account name or password, may try guessing what cannot be remembered. Guessing an account name can leave one trying an account that somebody else owns - and can cause account lock and blog deletion for somebody who they will never know.

Read More

Protect Your Online Life - Prevent Blog Loss

We've been seeing a few queries recently, in Blogger Help Forum: Get Help with an Issue, suggesting very subtle account attacks going on.

Some reports are about accounts locked (and blogs temporarily offline), because of "suspicious" / "unusual" activity. Other reports are sadder - and mention blogs now owned by another person. When we're able to identify the new blog owner, too many look like intentional hackers.

Temporarily offline - or permanently stolen - both are stories that you do not want to tell. Fortunately, both stories can be prevented.

If you know the risks, and you can protect yourself and your Blogger account, you can be simply irritated by the ongoing hacking attempts.

I, personally, am no stranger to semi successful hacking. This blog has been taken offline twice, since Blogger / Google started their hacking mitigation program ("suspicious" / "unusual" account activity detection).

Once the activity takes place, and is detected, your account will be locked, and your blogs taken offline - though you may not see the two conditions as connected. However, if you protect yourself, you can treat an attack as a mere nuisance.

Consider what details are used, by Google, in requesting backup authentication.

When Google requests additional identity details, after you have successfully provided your account name / email address, and your password, they will ask for demographic details such as:

• Any passwords that you have used previously.
• What services (such as GMail, Google+, YouTube) have you used - and when did you first use them.
• How recently did you use a given service.

They appear to request these details randomly, in an effort to keep the hackers guessing.

Observing that these details are sometimes requested, it would make sense to have a 2 part policy.

1. Don't reveal these details, about yourself, online.
2. Take a few hours, whenever you have time - research, and record these details so you will have them when they are useful.

If you travel frequently - or if your Internet service makes you appear to move around your immediate neighbourhood - you may need these details sooner than you would expect.

If your Internet service changes, giving you a new email address - or if you change jobs, graduate from school, move and have different / new Internet service - prepare for the change. The first time you login, after a change, have the details needed, where they can be conveniently retrieved.

You may see this notice - even when you did nothing wrong - if your account is disabled for "suspicious" / "unusual" activity. Google code can be fickle, at times.

Here's hoping that you don't suffer from high blood pressure or chronic indigestion.



Google 2-Step Verification is a better way to protect yourself.

Google 2-Step Verification uses any of several options.

• A physical USB key, registered by you before trouble starts.
• Backup, one use authentication codes, retrieved by you before trouble starts.
• An authentication code generator, installed on your smartphone / tablet, registered by you before trouble starts.

Note the requirement "before trouble starts". After you get the "Your account is now locked" advice, and see your blogs now offline, it may be too late.

I, personally, see the "suspicious" / "unusual" activity notice - or receive "Please provide additional proof of identity" - several times yearly. Using my USB key, inserted into the computer, and tapping the button, I am generally back online within minutes.

If you're lucky, you may need neither additional details, or 2-Step.

Not everybody will need either proof of identity. I suspect a large proportion of the world population will go through life without ever seeing the "suspicious" / "unusual" account activity warning.

And if I convince you to do any or all of this, you never need to do it - and you come to me in 5 years and call me a wanker or worse, for wasting your time - I'll smile and at least know that you are not one of the people in the forum.

My blog is offline and I had to spend time figuring when I setup my GMail and YouTube accounts!

or

Help me! My blog is missing from my dashboard - and it's throwing spam at my readers!

I really prefer being called a wanker (or worse).

---

Some Blogger blog owners are reporting new instances of "suspicious" / "unusual" account activity - some successfully executed, and blogs stolen. The sad part is that much of this can be avoided, by advance owner action.

Researching backup authentication details, and / or use of Google 2-Step Verification, can allow the owner of an attacked Blogger account to growl, and respond - and possibly have the account and blog(s) back online in minutes or hours. But the work has to be done before trouble starts.

Read More

True Online Anonymity Begins With A New Identity

We see occasional queries, from blog owners who require separation of their blog ownership from their real lives, in Blogger Help Forum: Learn More About Blogger.

I want to have myself anonymous, so that people do not know who I am when I blog. i think it will contribute to a more exciting blog!

An air of mystery is OK, as long as it's not being used to mask criminal activity.

Taking a public account and blog, and removing all personal details, can be an exercise in futility - or at least, ingenuity.

Blogger / Google code contains details, which may reveal too much.

We know that Blogger permits us - and will support us - to publish a blog, anonymously - with our blogging and real life identities kept separate. They don't provide details, though - possibly because each person may have their own ideas how separate they want everything to be.

Both Blogger accounts and blogs contain obscure details, which might be exploited by someone who is experienced in identity tracing.

One detail, which is frequently used in blog ownership analysis, is the "me" tag, in the blog header. The "me" tag is not documented - it's just there, in the blog source code.

I like to cook.

Who knows if the "me" tag in my "Recipe" blog, leading to my Google+ profile, could one day lead the wrong person to my door?



Who knows what other details may be present, in a Blogger / Google profile, or blog internal code?

For true anonymity, start with a clean account and blogs.

If you want true anonymity, start with a new Blogger account which contains no personally identifying content. And if possible, delete your current Blogger account.

Then setup a new Blogger blog - and again, add no personally identifying content. And do not link between anything in your clean, new Blogger account, and anything in any other accounts.

The best chance for anonymity starts with 100% isolation of the new Blogger account.

Conduct frequent personal identity audits, and educate yourself.

As you publish your blog, look at each opinion and story, and ask yourself how this could be used against you.

Spend some time on the Internet, and read about identity verification, pursuit of fugitives, and similar detective work. Spend some time reading stories about the US Witness Security (WitSec) Program, and similar programs in other countries - and how they protect their clients.

Their stories could become your learning opportunities.

True anonymity will have disadvantages.

If you truly make yourself anonymous, there will be no backdoor authentication details. You will not be able to recover control of the blog if you ever forget the account name or password.

If you remember account / password, you may not need backdoor authentication.

Neither Blogger: Forgot your username or password? - or Google: Having trouble signing in or viewing your blog? - will have any details which can be used to recover access, if you become truly anonymous. If there are any such details which could be used by you, to recover access or control, those details might be your downfall, when an experienced detective is put on your trail.

You will need protection from Google Hacking Detection, eventually.

If your account gets locked from "suspicious" / "unusual" activity, or when you change computers or travel, you will need anonymous backup authentication. You will need one or more components of Google 2-Step Verification. Just recording account name / password in a password storage vault won't help, if Google Hacking detection becomes involved.

You're going to have to have some backup authentication - just choose what you use selectively, keep it up to date, religiously - and never lose it.

---

Some #Blogger blog owners want to separate their blogging and personal lives - and want their blogs to not lead anybody to their real life existence. This can conflict with effective blog publishing - as a blog, by design, is an online extension of ones real life.

Given enough forethought, and research, it may be possible to separate our online life from real life - but it won't be a one time activity. Personal online anonymity will require constant self examination, and preparation.

Read More

If You Comment On Blogs Extensively, You Should Consider Using Google 2-Step Verification

One recently identified cause of deleted Blogger blogs appears to involve brute force hacking against our Blogger / Google accounts.

We've known, for some time, about blog owners receiving alerts about "suspicious" / "unusual" account activity. The alerts frequently involve locked or deleted Blogger / Google accounts - and generally include the owner having to change their password, solve a CAPTCHA, and / or provide their phone number (mobile or home phone) to login.

Later, people started reporting that their blogs were being deleted - possibly as a result of having to change their password, solve a CAPTCHA, and / or provide their phone number.

I've been observing - and blocking - an annoying style of comment based spam, which I have termed "nice blog" spam, for some time.

Nice blog. I will keep visiting this blog very often.

This style of spam, from what I can tell, has been published by the millions, in various blog comments, on both Blogger and non Blogger platforms.

The reason for the spam always intrigued me. Observing that the spam was published in the millions, suggested to me that it had a special purpose, intended by its creators. Looking at a typical spam message, in my email (since I moderate before publishing), I could see no consistent type of content.

• Some messages would contain links, others not.
• Some messages would mention what looked like commercial products, other references were obviously imaginary targets.
• Some messages would appear to be mere babble.

Recently, I discovered one strong possibility for the purpose of the spam - a very ingenious form of email address mining. The spam comment is only needed to allow a hacker to subscribe to a given comment stream, using the "Email follow-up comments to ..." option. It's possible that the subscription is not even affected by moderation - whether the blog owner is moderating, either before or after the comment is published to the blog, the hacker remains subscribed to the comment stream.

All that the hacker / spammer has to do is to publish a spam comment, select the "Email follow-up comments to ..." option, and watch while his Inbox fills up with subsequent comments from other Blogger / Google / OpenID account owners. Any comment containing an email address, and linking to a Blogger blog, would go straight into the hackers database.

Later, the hacker could go to work against the Blogger accounts referenced in the comments. In some cases, this would result in successfully hijacked Blogger blogs, which would become part of a spammers blog farm where advertisements of various nature could be hosted. Valuable blogs, with established reader populations, could also be used to serve malware (and more hacking) to unsuspecting readers.

The demographics of some hijacking attacks provide interesting clues. In one episode, we had a significant number of home / personal / small business blogs that had been hijacked by one specific individual. Many of the victim blogs

• Contained details relevant to the owners, which provided clues to passwords used by the owners.
• Were owned by people who used commenting extensively, for networking both with friends, and with business targets.
• Were read (and commented upon) by similar people, who similarly provided password clues in their own blogs.

Having been part of the restore process, both with people who had their blogs hijacked, and who had their accounts locked and blogs deleted, I observed that the former (hijacked blogs) seem to have decreased in volume as the latter (accounts and blogs locked / deleted) increased in volume. I don't think that the relationship is coincidental - or spurious.

My opinion is that the locking of Blogger / Google accounts - and subsequent deletion of blogs - directly results from detected attacks against the accounts in question ("suspicious" / "unusual" activity). Noting that the attacks seem to be more common to people who comment on blogs as a form of networking, it appears that commenting can lead to accounts and blogs being locked or deleted, as Google protects us against hacking.

Considering this possible cause and effect relationship, Google 2-step verification is a good idea. Click here, for Google instructions on setting up 2-step verification.

Use of 2-step verification helps safeguard our accounts against brute force hacking. This will help anybody who is anxious about accounts and blogs being deleted or locked, as a result of "suspicious" / "unusual" activity. If you own a blog which is subject to this threat, you should consider using 2-step verification.

The sanity (heart attack, ulcer) that is saved may be your own.

>> Top

Read More