That would be a great gift for potential hackers.

Indeed, I don't think it would be desirable to publish such a list. But it could still be generated and the users could be contacted privately. If deemed necessary, it's also possible to force privileged accounts to enable 2FA or to change their password on next login.

In T150853#2799024, @matmarex wrote:

Indeed, I don't think it would be desirable to publish such a list. But it could still be generated and the users could be contacted privately. If deemed necessary, it's also possible to force privileged accounts to enable 2FA or to change their password on next login.

Yeah, posting it publicly is just saying "hey, these are the accounts that are worth trying"

Keeping it private, and having a way to send emails/echo notifications to tell these admins to enable it, seems more sensible

[This task does not block publishing an analysis of the OurMine hack, hence I've removed that parent task.]

It may be that publishing dates of password changes would be more than can be queried from the public database, however a table of admins showing which had adopted 2FA is the type of thing that I would struggle to imagine as any significant extra risk and has good value as part of the community agreeing new policies for trusted accounts. In terms of targeting, this is probably a lot less significant than sharing user_properties or analysing edit patterns, which are available to anyone.

I agree that sharing account password metadata may assist targeting vulnerable sysop accounts, however we already have lots of public reports on-wiki which list out recently inactive admin accounts. I suspect that even moderately smart hackers are targeting accounts using that type of information in addition to prioritizing staff accounts and 'high profile' users for the extra lolz. It's not giving too much away to speculate that if I were a hacker I'd quietly target some of these dormant accounts to keep a backlog of hacked accounts, perhaps registering for 2FA. It's an unfortunate truth that there are many dormant sysop accounts where the user may never return, and odd edits may not get noticed, especially on non-English Wikipedia projects.

If making public a list of sysop accounts with old passwords is not sensible, it still would be a useful list for WMF staff to examine and share with 'crats or stewards who could make good use of it, such as making contact with vulnerable accounts in confidence. I'd actually expect such a user list being used already within the WMF security team.

In T150853#2799161, @Fae wrote:

It may be that publishing dates of password changes would be more than can be queried from the public database, however a table of admins showing which had adopted 2FA is the type of thing that I would struggle to imagine as any significant extra risk and has good value as part of the community agreeing new policies for trusted accounts. In terms of targeting, this is probably a lot less significant than sharing user_properties or analysing edit patterns, which are available to anyone.

The counterargument is, if the attacker knows who has 2FA enabled, then they will avoid those accounts, and thus their failures are less likely to show up in logs or otherwise be noticed. In certain (very unlikely scenario) where they have to crack hard hashes and are CPU limited, knowing who to target (e.g. who does not have 2FA) can be very valuable to the attacker.

I agree that sharing account password metadata may assist targeting vulnerable sysop accounts, however we already have lots of public reports on-wiki which list out recently inactive admin accounts. I suspect that even moderately smart hackers are targeting accounts using that type of information in addition to prioritizing staff accounts and 'high profile' users for the extra lolz. It's not giving too much away to speculate that if I were a hacker I'd quietly target some of these dormant accounts to keep a backlog of hacked accounts, perhaps registering for 2FA. It's an unfortunate truth that there are many dormant sysop accounts where the user may never return, and odd edits may not get noticed, especially on non-English Wikipedia projects.

Sure. Just because some info is (fairly unavoidably) public, doesn't mean we should expose all info.

If making public a list of sysop accounts with old passwords is not sensible, it still would be a useful list for WMF staff to examine and share with 'crats or stewards who could make good use of it, such as making contact with vulnerable accounts in confidence. I'd actually expect such a user list being used already within the WMF security team.

If we wanted to do some nag campaign, it would make more sense to do it in an automated fashion (e.g. When you log in, or a security email), then giving a list of people to stewards so they can shame them.