Please, Don't Try Guessing Your Account / Password!

We see too many problem reports, in Blogger Help Forum: Get Help with an Issue, about locked accounts and deleted blogs.

My Google account was suspended because of 'suspicious activities'. Last month, I realized that my two connected blogs, to that account, were also put offline!

Somebody else was unable to use the supplied account / blog recovery tools - and tried guessing what could not be remembered.

The first would be a blog owner, whose only mistake was having a Blogger account with a name similar to another account, owned by the second.

The second would be someone who could not remember her (his) account name / password, could not use account or password recovery, and who got well meaning advice.

Just do the best you can - try what may be your account name, and any passwords that you can remember!

One blog owner must suffer, because another cannot remember login details.

And owner #1 is suffering, because of owner #2. Owner #1 is now anxiously waiting for action by the security experts (with the blind queue of unknown length) to examine his blogs - and possibly, waiting while not knowing why.

Owner #1 may be seeing this - and not know why.



Password guessing may be necessary, in extreme cases - but it can cause misery - and owner #2 will never realise the pain caused to owner #1. Even if owner #2 recovers access to her / his blogs, innocent brute force attempts can cause account lock / blog security lock, to owner #1.

Protect yourself against the anguish, using Google 2-Step Verification.

The best way to protect against this sort of abuse is to use one or more Google Two Step Verification options. This will leave owner #2 seeing (for instance).

Insert your USB security key, and tap the lighted button.

And having no security key, owner #2 will simply have to try guessing a different account name. It may be an inconvenience (for owner #1), carrying a never used USB security key - but the one time it's needed (and available), it will make up for the inconvenience.

---

One #Blogger blog owner, unable to remember a necessary account name or password, may try guessing what cannot be remembered. Guessing an account name can leave one trying an account that somebody else owns - and can cause account lock and blog deletion for somebody who they will never know.

Read More

Protect Your Online Life - Prevent Blog Loss

We've been seeing a few queries recently, in Blogger Help Forum: Get Help with an Issue, suggesting very subtle account attacks going on.

Some reports are about accounts locked (and blogs temporarily offline), because of "suspicious" / "unusual" activity. Other reports are sadder - and mention blogs now owned by another person. When we're able to identify the new blog owner, too many look like intentional hackers.

Temporarily offline - or permanently stolen - both are stories that you do not want to tell. Fortunately, both stories can be prevented.

If you know the risks, and you can protect yourself and your Blogger account, you can be simply irritated by the ongoing hacking attempts.

I, personally, am no stranger to semi successful hacking. This blog has been taken offline twice, since Blogger / Google started their hacking mitigation program ("suspicious" / "unusual" account activity detection).

Once the activity takes place, and is detected, your account will be locked, and your blogs taken offline - though you may not see the two conditions as connected. However, if you protect yourself, you can treat an attack as a mere nuisance.

Consider what details are used, by Google, in requesting backup authentication.

When Google requests additional identity details, after you have successfully provided your account name / email address, and your password, they will ask for demographic details such as:

• Any passwords that you have used previously.
• What services (such as GMail, Google+, YouTube) have you used - and when did you first use them.
• How recently did you use a given service.

They appear to request these details randomly, in an effort to keep the hackers guessing.

Observing that these details are sometimes requested, it would make sense to have a 2 part policy.

1. Don't reveal these details, about yourself, online.
2. Take a few hours, whenever you have time - research, and record these details so you will have them when they are useful.

If you travel frequently - or if your Internet service makes you appear to move around your immediate neighbourhood - you may need these details sooner than you would expect.

If your Internet service changes, giving you a new email address - or if you change jobs, graduate from school, move and have different / new Internet service - prepare for the change. The first time you login, after a change, have the details needed, where they can be conveniently retrieved.

You may see this notice - even when you did nothing wrong - if your account is disabled for "suspicious" / "unusual" activity. Google code can be fickle, at times.

Here's hoping that you don't suffer from high blood pressure or chronic indigestion.



Google 2-Step Verification is a better way to protect yourself.

Google 2-Step Verification uses any of several options.

• A physical USB key, registered by you before trouble starts.
• Backup, one use authentication codes, retrieved by you before trouble starts.
• An authentication code generator, installed on your smartphone / tablet, registered by you before trouble starts.

Note the requirement "before trouble starts". After you get the "Your account is now locked" advice, and see your blogs now offline, it may be too late.

I, personally, see the "suspicious" / "unusual" activity notice - or receive "Please provide additional proof of identity" - several times yearly. Using my USB key, inserted into the computer, and tapping the button, I am generally back online within minutes.

If you're lucky, you may need neither additional details, or 2-Step.

Not everybody will need either proof of identity. I suspect a large proportion of the world population will go through life without ever seeing the "suspicious" / "unusual" account activity warning.

And if I convince you to do any or all of this, you never need to do it - and you come to me in 5 years and call me a wanker or worse, for wasting your time - I'll smile and at least know that you are not one of the people in the forum.

My blog is offline and I had to spend time figuring when I setup my GMail and YouTube accounts!

or

Help me! My blog is missing from my dashboard - and it's throwing spam at my readers!

I really prefer being called a wanker (or worse).

---

Some Blogger blog owners are reporting new instances of "suspicious" / "unusual" account activity - some successfully executed, and blogs stolen. The sad part is that much of this can be avoided, by advance owner action.

Researching backup authentication details, and / or use of Google 2-Step Verification, can allow the owner of an attacked Blogger account to growl, and respond - and possibly have the account and blog(s) back online in minutes or hours. But the work has to be done before trouble starts.

Read More