@Zppix: This has nothing to do with SRE nor Wikimedia-Site-requests. Please do not add these projects.

@Alexsh: Is this about 2FA on zhwiki? Or in some other place?

In T164265#3228031, @Aklapper wrote:

@Alexsh: Is this about 2FA on zhwiki? Or in some other place?

2FA is global.

In T164265#3228025, @Aklapper wrote:

@Zppix: This has nothing to do with SRE nor Wikimedia-Site-requests. Please do not add these projects.

You are not right. This can be done as a site request.

We don't currently have a policy, @Reedy seems to currently be willing to do it outside a policy, but at some point, we'll need a policy to avoid social engineering.

In T164265#3228190, @Urbanecm wrote:

2FA is global.

I'm pretty sure that 2FA for Phabricator is separate from global on-wiki things...

Yes, we've three places where two factors are configurable:

• Phabricator — https://phabricator.wikimedia.org/settings/ (regardless LDAP account or MediaWiki account is used as first factor)
• Wikitech — on wikitech.wikipedia.org (for LDAP account so)
• MediaWiki — linked to the SUL MediaWiki account

For LDAP login, the procedure is fully covered by https://wikitech.wikimedia.org/wiki/Password_reset#Reset_two_factor_authentication.

For MediaWiki, we don't have any procedure in place, but @Alexsh is welcome to suggest how they can prove the request is legitimate.

@Aklapper Phabiractor is a place where to request disabling 2FA for wikis :). As he mentioned certain wiki I guess it is about WMF wiki.

@Dereckson The phabricator account is connected to the MediaWiki SUL one. Would you accept this as a prove?

In T164265#3229220, @Urbanecm wrote:

The phabricator account is connected to the MediaWiki SUL one.

No it is not always (it can also be connected to LDAP/wikitech/Gerrit instead) and Phab's 2FA is separate. Hence I asked for clarification. Anyway... sorry for confusion! :)

In T164265#3230686, @Aklapper wrote:

In T164265#3229220, @Urbanecm wrote:

The phabricator account is connected to the MediaWiki SUL one.

No it is not always (it can also be connected to LDAP/wikitech/Gerrit instead) and Phab's 2FA is separate. Hence I asked for clarification. Anyway... sorry for confusion! :)

In another words, the Phab account we are talking about (where the request came from) is connected to the mw one which is required to be recovered. This connection can be accepted as a prove this is a legitimate request.

@Bawolff any thought about this?

In T164265#3228218, @Dereckson wrote:

We don't currently have a policy, @Reedy seems to currently be willing to do it outside a policy, but as some point, we'll need a policy to avoid social engineering.

Usually when I have a way of verifying people are who they say they are. Through knowing them personally, and contacting them other ways, or by having a third party in common who can verify them for me.

The technical part is easy. The social not quite so much

Usually, when people have a phab account tied to their end wiki account, I see this enough to action the request, if it's made through the account on phab

Okay, I'm going to confirm by e-mail with the requester if a mail account has been submitted, and proceed if we've this double Phabricator + mail confirmation.

I received a confirmation by mail, so it's okay for me.

Mentioned in SAL (#wikimedia-operations) [2017-05-04T06:09:30Z] <Dereckson> CentralAuth: Removed MediaWiki 2FA for Alexsh (T164265)

@Alexsh You should now be able to log in using just your password and re-add two factor authentication, this time saving the recovery keys on paper in a secure location perhaps.

Confirmed. Thank you very much, and I'll close this task.

You're welcome. Thanks for your patience.

I always CC @Jalexander and @jrbs on this kind of requests, and also add Trust-and-Safety, and treat these as private security issues.