Each Internet Service Maintains Their Own Accounts

Occasionally, we see a cry of anguish, about account recovery, in Blogger Help Forum: Get Help with an Issue.

I need to publish my blog, but I forgot the password. I can access my WordPress account though - and my photo - -on my WordPress blog - clearly is me. Can I speak to a real person, so I can get my Blogger blog back?

Here, we have a blog owner, who does not understand the relationship between Google, and non Google, services.

Different companies, which use the Internet, and / or provide services which let people use the Internet, have their own standards for account maintenance and recovery.

Long ago, I explored the Blogger policy for allowing non GMail email addresses to be used as account names.

Note differences between GMail based accounts, and non GMail based accounts.

With a Blogger account that uses a GMail email address, the Blogger account, the email address (GMail), and a Google account, are one account. With a Blogger account that uses a non GMail email address, the Blogger account and the email address share a name - but the Blogger account, and the email account, are two separate accounts.

• The Blogger account is a Google account, maintained by Google.
• The email address is part of an email account, maintained by a non Google company.

Setting up a Blogger account is simple - when you use a non GMail email address. You provide a non Google account name on the fly - when you create a blog, or when you accept membership in someone else's blog (in an ownership transfer, as a new author, or as a designated reader).

With non GMail based accounts, you only provide the email address.

You provide any non GMail email address (excepting a Google Apps / Google managed domain) as an account name, state the password that you will use for your new account, and you're done. If I state "nitecruzr@ficticious-domain.com" as my "email address", and provide an accepted password for future use, I now have a new Blogger account.

No verification is done, against the databases of "ficticious-domain.com" - to ensure that I, as a Blogger user, am a real person who should use the mailbox "nitecruzr" - or that "ficticious-domain.com" has a mailbox "nitecruzr" - or even, that "ficticious-domain.com" exists.

Given lax Blogger policy, should they be trusted by the domain owners?

Given that lack of common courtesy by Google, should my new Blogger account be accepted by the staff of "ficticious-domain.com", when I want to recover access to my "nitecruzr" mailbox on "ficticious-domain.com"?

I will email you my account reset request, from my Blogger / Google account. Since my Blogger / Google account is named "nitecruzr@ficticious-domain.com", you will know that it's me.

This seems like such an honest request.

The domain owners will contact Corporate Security, and report a hijack attempt.

Any competent IT staff member, receiving such a request, is going to make an immediate call to Corporate Security - because my "account reset" request is coming from a spoofed address, outside the company. Even if they don't send the local police to my physical address, they are certainly going to ignore my "account recovery" request.

Google should do the same, with someone using a FaceBook account.

Similarly, Google will do the same, when someone suggests that a FaceBook, Google+, or WordPress link to the blog, from the home page of a FaceBook, Google+, or WordPress account - or even from a FaceBook or WordPress account name that references the blog - be used for identity or ownership verification. Just mentioning a company resource - account or blog name - in a non company account or website page - does not prove account or blog ownership.

That is simple - and responsible - IT security policy. Account recovery requests cannot use any outside resources for documentation of identity or ownership.