⚓ T151414 LoginNotify cleanup

	Subject	Repo	Branch	Lines +/-
	Remove EchoBasicFormatter - no longer in use	mediawiki/extensions/LoginNotify	master	+3 -26

Status	Assigned	Task
Resolved	None	T14884 Login and account creation should be by secure http.
Invalid	None	T11816 Improve security for Special:Userlogin (tracking)
Invalid	Wikinaut	T3932 [DO NOT USE] ENotif/EConfirm & further enhancements (tracking) [superseded by #MediaWiki-Email]
Open	None	T125653 Create new types of notifications
Resolved	• demon	T11838 Send notification to account owner on multiple unsuccessful login attempts
Resolved	Bawolff	T151414 LoginNotify cleanup

Reedy created this task.Nov 22 2016, 10:31 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptNov 22 2016, 10:31 PM

Reedy mentioned this in T140167: Security Review of LoginNotify extension.Nov 22 2016, 10:32 PM

Theoretically the class extending EchoBasicFormatter should just be deleted - it won't be used because Echo now uses the presentation model and got rid of the old formatting system. See https://www.mediawiki.org/wiki/Extension:Echo/Creating_a_new_notification_type

Relying on $user->getRequest() is misleading IMO since it's using the global request, nothing specific to a user.

I was looking at the code, and I think it currently treats primary and secondary authentication failures the same right ? I'm wonder if with 2FA there will be a very different failure rate on the 2FA auth, and if we need different weight depending on the Authmanager plugin throwing it.

I don't think we will be able to determine that before hand, but maybe we should have some logging, which would allow us to evaluate the experience ?

In T151414#2820316, @TheDJ wrote:

I was looking at the code, and I think it currently treats primary and secondary authentication failures the same right ? I'm wonder if with 2FA there will be a very different failure rate on the 2FA auth, and if we need different weight depending on the Authmanager plugin throwing it.

I don't think we will be able to determine that before hand, but maybe we should have some logging, which would allow us to evaluate the experience ?

Yeah. Original this was written pre auth manager so secondary auth was not really a thing yet. That's a good point. Im not really sure what the correct answer is.

kaldari added a project: Community-Tech.Dec 24 2016, 12:28 AM

kaldari moved this task from New & TBD Tickets to Needs Discussion on the Community-Tech board.

kaldari added a parent task: T11838: Send notification to account owner on multiple unsuccessful login attempts.

kaldari mentioned this in T153335: Investigation: Notify on multiple unsuccessful login attempts.Dec 24 2016, 12:39 AM

Aklapper added a project: Technical-Debt.Dec 25 2016, 1:01 PM

Liuxinyu970226 edited projects, added MediaWiki-extensions-LoginNotify; removed MediaWiki-extensions-Other.Dec 27 2016, 4:35 AM

kaldari triaged this task as Medium priority.Jan 3 2017, 5:44 PM

kaldari set the point value for this task to 3.

kaldari moved this task from Needs Discussion to Up Next (May 20-June 3) on the Community-Tech board.

• DannyH edited projects, added Community-Tech-Sprint; removed Community-Tech.Jan 17 2017, 5:41 PM

Change 333671 had a related patch set uploaded (by Niharika29):
Remove EchoBasicFormatter - no longer in use

https://gerrit.wikimedia.org/r/333671