Elevated security protects against account takeover via XSS; if an attacker can grant rights to an account it legitimately owns, that protection is lost.
This is true both for MediaWiki core (Special:Userrights) and global rights management extensions such as CentralAuth.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T197160 All security-sensitive MediaWiki functionality should require elevated security | |||
| Open | None | T197136 Tie certain user rights to elevated security | |||
| Open | Feature | None | T197150 User right changes should require elevated security |
As someone who often changes user permissions locally and globally, requiring users to re-authenticate every time we need to change a permission would be overkill, at least from the perspective of the work we stewards do, and will lead to people using simple or easy passwords if they have to do this several times per day as it's our case (ie: something similar was argued not to force the users to change their passwords each Y days). Not that I'd use a weak password intentionally and put in danger the safety of our projects, nor my fellow stewards would do that of course; but it'd be quite annoying. Can we think of a different safety method? Please also note that changing userrights is always logged on Special:Log/rights so in principle weird changes of permissions can be quickly and easily spotted and reverted.
AIUI, as long as the permissions changes are within $wgReauthenticateTime of the last login you shouldn't be prompted again?
Yeah. There's a tradeoff here as on the one hand frequent reauthentication is annoying, on the other hand if someone does right changes a log and the timeout is long enough that they have elevated security most of the time, then it doesn't really offer any protection.
I'm not sure, but If you assume this apply same logic as password change, must I input password and 2FA for each re-authorize? if that so, some one disable a 2FA IMHO. I like same logic as Google's implement. Also phabricator's high security mode. Current OATHAuth does not supplying option to bypass a prompt for "Trusted devices".
I'd be that someone if 2FA is always forced on me every day — Stewards do make use of Special:UserRights every day or so, and being forced to enter 2FA every day — that would be too much disadvantage (I'll have to think of it as penalty) of using 2FA.
I've activated 2FA on phabricator and I already find that annoying. Let alone when I need to use that for user right changes and, even worse, for checkuser actions (T197158).
This came up in discussions around T197137 after T419137, as something that makes sense for Special:UserRights in core, as well as Special:GlobalGroupPermissions and Special:GlobalUserRights in CentralAuth.