Thank you for the very clear question, Aklapper, it makes my bug report look rather shoddy by contrast. Indeed, your numbered list is exactly what I did. After giving my unified login credentials and pressing "Allow", I got the message

"Registration Failed
Your browser did not submit a registration key with the request. You must use the same browser to begin and complete registration. Check that cookies are enabled and try again."

If this message could say "You need cookies enabled for [list of domains]", it would be much more helpful to those with cookie settings other than "on" and "off".

I had cookies from wikimedia.org and phabricator.wikimedia.org enabled, and it still failed repeatedly. Even after clearing all cookies and cookielikes and closing and restarting the browser, it did not work. I then enabled third-party cookies and it worked; I was registered. I've since turned them off again and have had no problems.

Due to the limitations of my browser's settings, the enabling of third-party cookies was done through an add-on. I am looking into whether there is a problem with the add-on, but I assumed, possibly incorrectly, that there is some point here at which a domain does something with cookies from another domain.

Apologies for the multi-part task, and thank you for the link to https://www.mediawiki.org/wiki/Phabricator/Help. Could a question-mark icon or some such next to the e-mail field link to that help page?

"A valid email address will also be required for verification, but not shown to other users" does not really explain why it is required. "We don't want to be flooded with trolls" is a legitimate reason, but in that case an exception might be made for established wiki editors of good repute. In either case, if e-mail is required for Phab registration, this exception probably needs to be noted in the linked https://foundation.wikimedia.org/wiki/Privacy_policy:

"Because we believe that you shouldn’t have to provide personal information to participate in the free knowledge movement, you may:

-Read, edit, or use any Wikimedia Site without registering an account.
-Register for an account without providing an email address or real name."

The privacy policy does list some Wikimedia sites which are exceptions, but the list does not include Phab.

Another side issue, but I got 16 emails within a day of registration using the default settings, which seem to ~never notify where one can e-mail. I changed the default settings, so fixed, but it's a bit intimidating. I'd have been happy to express a preference for notifications over e-mails during registration. Probably not worth changing unless a fair number of others feel the same way.

Cookies: I think https://phab.wmfusercontent.org/ is the culprit. The string in Phab's code base is in /src/applications/auth/controller/PhabricatorAuthController.php:

'Your browser did not submit a registration key with the request. '.
'You must use the same browser to begin and complete registration. '.
'Check that cookies are enabled and try again.'));

In Wikimedia we could locally overwrite that and mention domains, by using translation.override in https://phabricator.wikimedia.org/source/operations-puppet/browse/production/modules/phabricator/data/fixed_settings.yaml . See https://www.mediawiki.org/wiki/Gerrit/Tutorial if you are interested in proposing a patch in Gerrit (against the operations/puppet repository).

if e-mail is required for Phab registration, this exception probably needs to be noted in the linked https://foundation.wikimedia.org/wiki/Privacy_policy:

That's also my current understanding. Could you create a separate task about that specifically?

I'd have been happy to express a preference for notifications over e-mails during registration.

https://www.mediawiki.org/wiki/Phabricator/Help/Managing_mail is linked from https://www.mediawiki.org/wiki/Phabricator/Help#Receiving_updates_and_notifications . We link to that Help page from the Phabricator frontpage.

I cannot reproduce any difficulties registering a Phab account if third-party cookies are not enabled in Chromium 114.
Chromium 114. "Settings > Privacy and security > Block third-party-cookies" is enabled.

Currently, the page within Phabricator at https://phabricator.wikimedia.org/auth/start/?next=%2F which allows logging in or registering a user account links in its footer to https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Privacy_policy and https://foundation.wikimedia.org/wiki/Policy:Terms_of_Use/Phabricator .

Issue: That current Privacy Policy URL says for example "You do not need to create an account to use any Wikimedia Site. If you do create an account, you do not need to give us your name or email address." That is misleading in case of Wikimedia Phabricator as it is required to set an email address when registering a user account in Wikimedia Phabricator.

What to do?

• Maybe we should change the Phabricator footer to link to https://foundation.wikimedia.org/wiki/Policy:Non-wiki_privacy_policy instead of current https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Privacy_policy ? That could be done by patching ui.footer-items in https://gitlab.wikimedia.org/-/ide/project/repos/phabricator/deployment/tree/wmf/stable/-/scap/templates/phabricator/conf/local/local.json.j2/ in GitLab.
• Also, we could add additional information to the custom text on https://phabricator.wikimedia.org/auth/start/?next=%2F which currently says "Click the MediaWiki button below to connect your Wikimedia unified account. Alternatively, click the Wikitech Account (LDAP) button to connect your Developer account credentials. In case of doubt, check the Phabricator Help." ? This can be done by Phab admins at https://phabricator.wikimedia.org/auth/message/1/ . Question is if it makes sense, and what exactly we would add.

Historical context: T198: Draft a terms of use

aklapper opened https://gitlab.wikimedia.org/repos/phabricator/deployment/-/merge_requests/25

Use WMF Non-wiki privacy policy

brennen merged https://gitlab.wikimedia.org/repos/phabricator/deployment/-/merge_requests/25

Use WMF Non-wiki privacy policy