Feature summary (what you would like to be able to do and where):
On Wikipedia, Wikiquote, and other Wikimedia wikis, LTAs and vandals often abuse the e-mail user feature, while this is a problem, it is not in itself a security issue. The security issue happens if the victim replies. While there are warnings against this, some users may not see them, or the e-mail might seem legitimate.
There are two main issues:
- E-mail shutdowns: A malicious user can fake e-mails from the victim, then report the victim to their e-mail provider, resulting in their e-mail being terminated.
- Spam/harassment: After getting the real e-mail of the victim, the attacker can send them malicious e-mails manually or sign their e-mail up for spam lists.
Here's how this could be solved:
Rather then having e-mails sent and received from real addresses, a proxy would used instead. Example: if a malicious user with the email address lta@vandalism.com sent an e-mail to a legitimate user with the email address wikicontributor@email.site, it would go like this:
- The e-mail would be sent from lta@vandalism.com to a temporary proxy (something like 0678378e6c879b99@securemail.wikimedia.org), then it would be confirmed and a header giving the name of the sender would be added
- The e-mail would be sent from the sending proxy to the receiving one (e.g. 0678378e6c879b99@securemail.wikimedia.org to 6d38c9e82c3f5edf@securemail.wikimedia.org)
- The e-mail would be sent from the receiving proxy to the end-user (i.e. 6d38c9e82c3f5edf@securemail.wikimedia.org to wikicontributor@email.site)
Replying would be done entirely using these proxies with no risk of their real e-mails being exposed. If a proxy e-mail gets spammed, it can be reset or disabled. If a users replies to a proxy that has been de-activated, they would be sent an automatic message saying that it would need to be sent using the e-mail user feature again. Checkusers could still see the real e-mails if needed.
Use case(s) (list the steps that you performed to discover that problem, and describe the actual underlying problem which you want to solve. Do not describe only a solution): See above.
Benefits (why should this be implemented?): See above.