Project documentation
Meta - Community health initiative/Mechanisms to prohibit blatant attack usernames
High-level goal
Decrease harassment by disallowing users from creating blatant attack usernames (e.g. User:Foobar_is_a_jerk being created to attack User:Foobar)
Prioritization rationale
This will likely be a feature we develop in 2018.
Some rouge thoughts:
Make it a special page where only admins and stewards can add usernames and see it. Currently we do that via m:Title blacklist which lists the regex publicly and therefore it is very easy to circunvent. I also would like to add that we need to convert MediaWiki:Email-blacklist in a special page only visible for admins/stewards as email addresses or domains are private information covered by the WMF privacy policy and also, due to WP:BEANS, if we expose which domains or email addresses are banned from account creation is shooting ourselves in the foot. Thanks.
Yes, I agree that any successful system will have to have restricted access, for exactly the reasons you mentioned.