Investigation: Notify on multiple unsuccessful login attempts
Closed, ResolvedPublic5 Story Points

Description

Bawolff worked on T11838: Send notification to account owner on multiple unsuccessful login attempts, which started in March and stopped in April.

What can we do to move this forward? Are there blockers we can clear?

DannyH created this task.Dec 15 2016, 5:36 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptDec 15 2016, 5:36 PM
kaldari set the point value for this task to 5.Dec 20 2016, 10:40 PM
Niharika claimed this task.Dec 22 2016, 3:09 PM
Niharika edited projects, added Community-Tech-Sprint; removed Community-Tech.
Niharika moved this task from Ready to In Development on the Community-Tech-Sprint board.
Niharika added a subscriber: Bawolff.EditedDec 23 2016, 3:36 PM

    • Uses IP caching and/or CheckUser to detect if login is from a known IP.
  • Things we can work on:
    • The security review (T140167) created T151414: LoginNotify cleanup which lists a bunch of outstanding things that need to be done before the extension is deployable.
    • T135270: Update LoginNotify for AuthManager outlines a couple of hooks that need to be updated.
    • The code currently has 11 FIXME's and 7 TODO's which could definitely be investigated and worked on to make the code more reliant, long term.
  • Things to think about:
    • The extension currently works on per-wiki basis. It would be a good idea to think about making it work with CentralAuth to detect login attempts on any of the wikis the user is attached to. Though the wishlist proposal doesn't mention it, it seems like an implicit given.

@Bawolff does the above seem accurate?

Yes that's accurate. Fixing up the code for AuthManager and echo changes (and other TODOs) is on my todo list, my todo list is just a little long right now :)

Feature wise, I'm also planning to add looking at rc_ip to see if user has previously logged in for wikis without checkuser.

CentralAuth wise - this is somewhat mitigated by global notifications and using email notifications - assuming it is enabled on all wikis - so if it was enabled by default, this would address it, but I'm not sure if we want to enable by default. Perhaps we do, I don't know.

I will note, that if CentralAuth is enabled, the extension looks at the checkuser table from up to 10 other wikis, not just the current wiki, when determining if the user has previously used the IP.

The extension currently works on per-wiki basis. It would be a good idea to think about making it work with CentralAuth to detect login attempts on any of the wikis the user is attached to. Though the wishlist proposal doesn't mention it, it seems like an implicit given.

This seems like it isn't really much of an issue due to global notifications (as Brian mentioned).

The extension currently works on per-wiki basis. It would be a good idea to think about making it work with CentralAuth to detect login attempts on any of the wikis the user is attached to. Though the wishlist proposal doesn't mention it, it seems like an implicit given.

This seems like it isn't really much of an issue due to global notifications (as Brian mentioned).

Actually I just realized. If an attacker decided to use login.wikimedia.org to login, they could get around this extension since there is no echo installed on that wiki, so no global echo notice would be generated.

Actually I just realized. If an attacker decided to use login.wikimedia.org to login, they could get around this extension since there is no echo installed on that wiki, so no global echo notice would be generated.

@Bawolff: Any ideas for how to address that? If someone tries to log in as me on loginwiki I don't want to get separate notifications on hundreds of different wikis.

The first thing that comes to mind is either enable echo on all sul wikis or use the job queue to send the notice on some fallback wiki.

kaldari closed this task as Resolved.Dec 24 2016, 12:39 AM

Created two follow-up tasks:

  • T154064 Investigation: What would be the best way to support loginwiki from LoginNotify
  • T154065 Create new Phabricator project tag for LoginNotify extension

Other issues are covered by T135270 and T151414.