Tell users to use a unique password when creating an account and changing their password
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Bawolff
	Dec 22 2015, 11:42 AM

Description

On https://meta.wikimedia.org/wiki/Special:MyLanguage/Requests_for_comment/Password_policy_for_users_with_certain_advanced_permissions it was suggested by User:°, that the instructions for creating an account/changing password, should instruct users to use a unique password, and not share across multiple websites.

Details

Subject	Repo	Branch	Lines +/-
signup: added help message for security	mediawiki/core	REL1_35	+10 -0
signup: added help message for security	mediawiki/core	master	+10 -0
wip	mediawiki/core	master	+2 -0

Customize query in gerrit

Related Objects

Mentioned In: T200052: Mandate that account passwords must be a minimum of eight characters on Wikimedia projects
T160031: Improve failed login notifications in LoginNotify extension

Event Timeline

Bawolff created this task.Dec 22 2015, 11:42 AM

Bawolff raised the priority of this task from to Low.

Bawolff updated the task description. (Show Details)

Bawolff added a project: Security-Team.

Bawolff added subscribers: Aklapper, Bawolff, StudiesWorld.

Krenair added a project: MediaWiki-User-login-and-signup.Dec 22 2015, 3:50 PM

Krenair subscribed.

Do we class this as a design issue?

Gradzeichen mentioned this in T160031: Improve failed login notifications in LoginNotify extension.Mar 23 2017, 10:34 AM

Tgr mentioned this in T200052: Mandate that account passwords must be a minimum of eight characters on Wikimedia projects.Jul 24 2018, 8:59 AM

Reedy renamed this task from Tell users to use a unique password when creating an account. to Tell users to use a unique password when creating an account.Oct 21 2019, 7:02 PM

• chasemp moved this task from Incoming to Back Orders on the Security-Team board.Dec 2 2019, 8:52 PM

I'll give this a try..

Change 555012 had a related patch set uploaded (by Apap04; owner: Apap04):
[mediawiki/core@master] wip

https://gerrit.wikimedia.org/r/555012

gerritbot added a project: Patch-For-Review.Dec 6 2019, 4:51 AM

Apap04 added a project: User-Apap04.Dec 6 2019, 4:45 PM

Change 555012 abandoned by Apap04:
wip

Reason:
Bad branch, need to make new one.

https://gerrit.wikimedia.org/r/555012

Maintenance_bot removed a project: Patch-For-Review.Dec 6 2019, 8:10 PM

Change 555601 had a related patch set uploaded (by Apap04; owner: Apap04):
[mediawiki/core@master] signup: added help message for security

https://gerrit.wikimedia.org/r/555601

gerritbot added a project: Patch-For-Review.Dec 6 2019, 8:17 PM

Apap04 moved this task from Waiting for sorting to Working on on the User-Apap04 board.Dec 6 2019, 8:24 PM

Does this look fine? Tell me if the wording should be different.

Reedy renamed this task from Tell users to use a unique password when creating an account to Tell users to use a unique password when creating an account and changing their password.Dec 8 2019, 6:07 PM

With pwordbr:

Screenshot 2019-12-12 at 00.13.04.png (516×674 px, 56 KB)

Without pwordbr:

Screenshot 2019-12-12 at 00.13.46.png (484×648 px, 55 KB)

@Volker_E @matmarex ^

help-message from HTMLForm could be modified in a different patch so a bit of spacing is given at the bottom?

So in order to make this really useful, it should be a label element with a for attr in order for screen reader users to be clearly connected to the element.
See for example https://doc.wikimedia.org/oojs-ui/master/demos/?page=layouts&theme=wikimediaui&direction=ltr&platform=desktop#FieldLayout-aligned-top-with-inlined-help

This is also the correct styling of additional, secondary labels. Note the white-space connecting it visually to the first and related password input and not to the second.

• chasemp moved this task from Back Orders to Watching on the Security-Team board.Dec 16 2019, 5:11 PM

sbassett subscribed.Feb 13 2020, 8:06 PM

Krinkle unsubscribed.Feb 13 2020, 10:12 PM

Change 555601 merged by jenkins-bot:
[mediawiki/core@master] signup: added help message for security

https://gerrit.wikimedia.org/r/555601

Maintenance_bot removed a project: Patch-For-Review.Aug 24 2020, 4:10 PM

ReleaseTaggerBot added a project: MW-1.36-notes (1.36.0-wmf.6; 2020-08-25).Aug 24 2020, 5:00 PM

(Seems to be resolved with that patch)

valerio.bozzolan subscribed.Mar 22 2021, 1:14 PM

Change 674050 had a related patch set uploaded (by Reedy; owner: Apap04):
[mediawiki/core@REL1_35] signup: added help message for security

https://gerrit.wikimedia.org/r/674050

gerritbot added a project: Patch-For-Review.Mar 22 2021, 3:18 PM

Change 674050 merged by jenkins-bot:
[mediawiki/core@REL1_35] signup: added help message for security