Thursday, April 29, 2010

Blogger Provides Blog Access Using Two Factor Authentication

Many bloggers are confused about how to protect their blogs, both from unauthorised administrative access, and unauthorised viewing. An example of the confusion is the occasional question
How do I set a password in my blog, to prevent unwanted viewers?
and the correct answer here is simple.
You can't set a password. Blogger uses two factor authentication, to protect your blog.

If you own a house or a car, you may occasionally wish to provide guest access to your house or car. Maybe you have an extra key, which you lend to your guests, so they may use your house or car at their convenience. If you've done this, you may observe inconveniences caused by availability of a shared key.
  • A key may be lost, necessitating re keying of the locks, and distribution of a new key to all who have access.
  • You may not wish for your guests to have access to the entire house or car, at all times.
  • You may not wish for your guests to have access to the entire house or car, permanently.
  • Your guests may decide that carrying another key, on a separate key ring, may be too much trouble. They may wish to put your key on their key ring. This can cause more complications.
  • Distributing, and maintaining, a key library to everybody may simply be a lot of work.
In higher priced houses or cars, people have discovered the advantages of using electronic locks, which can provide more choices than simply providing a single key, available identically to everybody.

Blogger uses two factor authentication, which is equivalent in sophistication to the electronic lock which you use (or may wish to use) on your house or car. This allows you, and your guests, convenient and protected access to your blog. Two factor authentication provides more convenience, and protection, to both of you.
  • You identify your guest by their public email address, and send them an invitation to your blog.
  • Your guest accepts the invitation, using the Blogger account of their choice, and using their own personal password.
  • You are safe from your guest, and your guest is safe from you, from either of you knowing too much about each other.

If you wish to provide additional access to your blog - either another administrator, another author, or a designated reader, use the Settings - Permissions wizard, and add a member of the appropriate type. That's how you manage blog access.

>> Top

2 comments:

kurt wismer said...

i'm afraid i can't quite see how blogger uses 2-factor authentication. authentication for blogger is done exclusively with things the user knows, which amounts to only 1 factor (even the wikipedia article you linked to refers to it as 1 factor).

in order for it to be 2 factor you'd have to include something in addition to things you know, such as things you have (tokens, house keys, etc) or things you are (biometrics).

Chuck said...

Kurt,

The Wikipedia article refers to "(passport + PIN)", which is really the same as "(account + password)". "passport / account" is publicly known (by some people other than you), and "PIN / password" is privately known (encrypted, and known only by you).

The most basic, and earliest, two factor authentication is "account / password". That's been around for years.