[IP Masking] Do not show logged-in version of Special:CreateAccount page to temp accounts
Open, MediumPublic
Actions

Assigned To

None

Authored By

	RHo
	Feb 2 2023, 11:16 PM

Description

User story

As an unregistered editor who has decided to create an account understanding it will not be tied to my unregistered edits,
I want assurance that my new account identity is separate,
So that I can be assured about my anonymity.

Problem(s)

Currently the temp account is being shown the version of Special:CreateAccount page for logged in users.

01. Navigate to Special:CreateAccount in temp user state with unexpected fields (send temp password to email, rationale)	google translated de betalabs version
02. Filled in with new account
03. Person is now logged in as new account in Newcomer homepage welcome survey
04. Going to Special:Log?type=newusers and it is shown publicly that *Unregistered_2828 created the account

Proposed solution

Show a specific version of Special:CreateAccount for temp accounts which does not ask for a rationale, and doesn't have the send a temp password to an email field.
Do not show the unregistered account that created the new account in Special:Log&page=&tagfilter=&type=newusers

Related Objects
Search...

Status	Assigned	Task
In Progress	• Niharika	T324492 Temporary accounts - MVP
Open	None	T326816 Update features for IP Masking
Open	KStoller-WMF	T326877 [Epic] Update Growth Team-owned products that may be affected by IP Masking
Open	None	T328718 [IP Masking] Do not show logged-in version of Special:CreateAccount page to temp accounts
Open	None	T357498 Non-autocreated temp accounts creations do not appear in Special:Log

Event Timeline

RHo created this task.Feb 2 2023, 11:16 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptFeb 2 2023, 11:16 PM

Tchanders added a project: Anti-Harassment.Feb 20 2023, 3:57 PM

Tchanders subscribed.

Tgr moved this task from Inbox to Triaged on the Growth-Team board.Feb 21 2023, 5:47 AM

Going to Special:Log?type=newusers and it is shown publicly that *Unregistered_2828 created the account

One danger here is that the IP addresses of temporary accounts are available more widely than the IP addresses of registered accounts. (Admins and patrollers will be able to access them.) By linking a temporary and a registered account, we are exposing the IP addresses of that registered account more widely.

• Prtksxna subscribed.Mar 6 2023, 10:55 AM

Umherirrender renamed this task from [IP Masking] Do not show logged-in version of Create:SpecialAccount page to temp accounts to [IP Masking] Do not show logged-in version of Special:CreateAccount page to temp accounts.Mar 29 2023, 7:43 PM

There is message "createacct-temp-warning" (The edits you made with your temporary account will not be carried over to your permanent one.), so only the temp password and the reason field should be removed and the auth process must not use the temp user to log

Umherirrender unsubscribed.May 1 2023, 12:14 PM

Urbanecm_WMF added a project: IP-Masking-Growth-Team.Aug 29 2023, 2:06 PM