Tagging Wikimedia-Site-requests; while we might not want to force 2FA, we probably want to make sure we hold these accounts to higher password policies etc.

What permissions should this group have? The same as the staff group?

In T277223#6906664, @Zabe wrote:

What permissions should this group have? The same as the staff group?

Please don't process this from a site request perspective yet, the exact details are not yet known

In T277223#6906695, @Majavah wrote:

In T277223#6906664, @Zabe wrote:

What permissions should this group have? The same as the staff group?

Please don't process this from a site request perspective yet, the exact details are not yet known

Ok, sorry, I was just confused.

Also, it would be created/modified via https://meta.wikimedia.org/wiki/Special:GlobalGroupPermissions rather than "just" in IS/CS

Note that global groups can currently be maintained only by stewards. Creating a global group for all staff members would need some code in CentralAuth to let ITS to grant only this group globally. A local group would work, but I don't see much use in that.

@Niharika Why don't you just query for all unlocked accounts that end with (WMF)?

In T277223#6906664, @Zabe wrote:

What permissions should this group have? The same as the staff group?

My understanding is that there would be no additional rights assigned to this group, it would essentially function as a label or a category. However...

In T277223#6906517, @Reedy wrote:

Tagging Wikimedia-Site-requests; while we might not want to force 2FA, we probably want to make sure we hold these accounts to higher password policies etc.

Yep, I think this is a great point, though I imagine "WMF" accounts are already pretty juicy from an attacker's perspective

In T277223#6906851, @Urbanecm wrote:

@Niharika Why don't you just query for all unlocked accounts that end with (WMF)?

Not all staff accounts end with (WMF) (e.g. User:GVarnum-WMF).

Seems like you may want to simply query for not locked+"WMF" and manually clean the resulting list from false positives.

In T277223#6907432, @jrbs wrote:

In T277223#6906664, @Zabe wrote:

What permissions should this group have? The same as the staff group?

My understanding is that there would be no additional rights assigned to this group, it would essentially function as a label or a category. However...

Note that from site requests perspective, it's not clear where exactly should this group live. It can be marked as privileged group through, so it has oathauth-enable + stricter password policies.

In T277223#6906517, @Reedy wrote:

Tagging Wikimedia-Site-requests; while we might not want to force 2FA, we probably want to make sure we hold these accounts to higher password policies etc.

Yep, I think this is a great point, though I imagine "WMF" accounts are already pretty juicy from an attacker's perspective

In T277223#6906851, @Urbanecm wrote:

@Niharika Why don't you just query for all unlocked accounts that end with (WMF)?

Not all staff accounts end with (WMF) (e.g. User:GVarnum-WMF).

You can query for WMF anywhere in the account + unlocked. It will allow special accounts like "WMFOffice" to vote, but then we can trust the account holders to not abuse this "permission", and scrutineers to notice that happened.

This task looks stale to me. Can it be closed?