Smile! (and account security)

Google is unrolling a new way to make your Google account recoverable if you forget your password, are hacked, or otherwise lose access. ¶ 

Your picture. ¶ 

"Selfie for sign-in" joins the other three methods (or four, depending on how you count things) for verifying your identity in case there is ever a question. ¶ 

Do not think this cannot happen to you. ¶ 

Like these other methods, there is a catch: you have to set it up before you lose access.

There is also a way that Selfie could make your account less secure.

Your account

Your Blogger account is a Google account, and it's possible to lose access to it and your blog due to hacking, absence, errors by Google, even buying a new phone.

If you've set up recovery options, you can usually restore access easily. Generally, the more of these options you set up, the better off you will fare.

The promise of Selfie for Sign in is to give you "more options if you’re ever locked out or don’t have access to your usual phone or computer."

These are account options, not Blogger settings. (If you do not believe your blog is connected to Google, click that link!)

Multiple options

The most important recovery options to have, in my view are 

• a recovery email (which needs to be a different email than the gmail attached to the account, if there is one)
• a recovery phone that accepts texts and is not a Google Voice number linked to the account

If you have set up two-factor verification, you can also create

• one-time backup codes

These are pretty bullet prove. If you've created them, there is an opportunity to enter them during the recovery process ("try another way").

In the past year, Google has added Selfie, which lets you prove your identity with a photo, and also

• Trusted Contacts (with which a friend can verify your identity).

These are all enabled in your Google Account settings, not in Blogger. (If you do not believe you have a Google account, click on that link!)

And yeah, you have to set these up before you lose access to your account.

I wrote about Trusted Contacts last year. I've said repeatedly that everyone should set up recovery email and phone (and keep them current).

So, is Selfie a good idea?

A biometric security hole?

For most of us, it is. Maybe all of us! But there is a legal twist people in America should know.

In the United States, courts have consistently held that the US Constitution protects passwords: you cannot be compelled to unlock a device or account with a password or to provide it to law enforcement.

However, the courts seem to be breaking the other way with respect to biometric data, like faces. So in theory, enabling Selfie for your account could allow law enforcement into it—by taking your photo.

Consider, however, that if you already allow biometric unlock of your device, such as facial or fingerprint recognition, you've already left that door open.

The photograph of the Buddhist monks, taken by Senior Airman Jette Carr (USAF), is in the public domain.