[IP Masking] Do not show logged-in version of Special:CreateAccount page to temp accounts
Closed, ResolvedPublic3 Estimated Story Points
Actions

Assigned To

Authored By

	RHo
	Feb 2 2023, 11:16 PM

Project Tags

Referenced Files

	F57498089: image.png
	Sep 11 2024, 6:30 AM

	F57498065: image.png
	Sep 11 2024, 6:30 AM

	F57498047: image.png
	Sep 11 2024, 6:30 AM

	F36687914: image.png
	Feb 2 2023, 11:16 PM

	F36687901: image.png
	Feb 2 2023, 11:16 PM

	F36687899: image.png
	Feb 2 2023, 11:16 PM

	F36687895: image.png
	Feb 2 2023, 11:16 PM

Subscribers

View All 9 Subscribers

Description

User story

As an unregistered editor who has decided to create an account understanding it will not be tied to my unregistered edits,
I want assurance that my new account identity is separate,
So that I can be assured about my anonymity.

Problem(s)

Currently the temp account is being shown the version of Special:CreateAccount page for logged in users.

01. Navigate to Special:CreateAccount in temp user state with unexpected fields (send temp password to email, rationale)	google translated de betalabs version
02. Filled in with new account
03. Person is now logged in as new account in Newcomer homepage welcome survey
04. Going to Special:Log?type=newusers and it is shown publicly that *Unregistered_2828 created the account	(T364716: Do not show link between named account and temporary account in RecentChanges and Special:Log)

Acceptance Criteria:

Show a specific version of Special:CreateAccount for temp accounts which does not ask for a rationale, and doesn't have the send a temp password to an email field.

Note: T364716: Do not show link between named account and temporary account in RecentChanges and Special:Log can be handled separately.

Details

Related Changes in Gerrit:

	Subject	Author	Repo	Branch	Lines +/-
	auth: Disable irrelevant account creation fields for temp users	Máté Szabó	mediawiki/core	master	+265 -9
	auth: Split TemporaryPasswordPrimaryAuthenticationProviderTest cases	Máté Szabó	mediawiki/core	master	+570 -334

Customize query in gerrit

Related Objects
Search...

Status	Assigned	Task
		Restricted Task
Resolved	kostajh	T294511 2021 Security Team wikireplicas audit
Declined	None	T284948 Raw IPs of logged-out users disclosed in wiki-replicas
Resolved	• Niharika	T324492 Temporary accounts - MVP
Resolved	Madalina	T326816 [Epic] Update features for temporary accounts
Resolved	KStoller-WMF	T326877 [Epic] Update Growth Team-owned products that may be affected by IP Masking
Resolved	• mszabo	T328718 [IP Masking] Do not show logged-in version of Special:CreateAccount page to temp accounts
Resolved	Dreamy_Jazz	T357498 Temp account creations do not appear in Special:Log

Event Timeline

RHo created this task.Feb 2 2023, 11:16 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptFeb 2 2023, 11:16 PM

Tchanders added a project: Anti-Harassment-Team.Feb 20 2023, 3:57 PM

Tchanders subscribed.

Tgr moved this task from Inbox to Triaged on the Growth-Team board.Feb 21 2023, 5:47 AM

Going to Special:Log?type=newusers and it is shown publicly that *Unregistered_2828 created the account

One danger here is that the IP addresses of temporary accounts are available more widely than the IP addresses of registered accounts. (Admins and patrollers will be able to access them.) By linking a temporary and a registered account, we are exposing the IP addresses of that registered account more widely.

• Prtksxna subscribed.Mar 6 2023, 10:55 AM

Umherirrender renamed this task from [IP Masking] Do not show logged-in version of Create:SpecialAccount page to temp accounts to [IP Masking] Do not show logged-in version of Special:CreateAccount page to temp accounts.Mar 29 2023, 7:43 PM

There is message "createacct-temp-warning" (The edits you made with your temporary account will not be carried over to your permanent one.), so only the temp password and the reason field should be removed and the auth process must not use the temp user to log

Umherirrender unsubscribed.May 1 2023, 12:14 PM

Urbanecm_WMF added a project: IP-Masking-Growth-Team.Aug 29 2023, 2:06 PM

Moving this into the Growth team backlog, as I imagine this is a MVP release requirement.

KStoller-WMF triaged this task as Medium priority.Nov 7 2023, 8:24 PM

Tchanders mentioned this in T357498: Temp account creations do not appear in Special:Log.Feb 26 2024, 11:12 AM

kostajh added a subtask: T357498: Temp account creations do not appear in Special:Log.Feb 26 2024, 12:49 PM

• TAdeleye_WMF edited projects, added: Trust and Safety Product Team; removed: Anti-Harassment-Team.May 14 2024, 4:16 PM

kostajh updated the task description. (Show Details)May 21 2024, 1:43 PM

KStoller-WMF moved this task from Backlog to Estimated tasks backlog on the Growth-Team board.May 21 2024, 10:24 PM

KStoller-WMF raised the priority of this task from Medium to High.May 23 2024, 4:45 PM

KStoller-WMF updated the task description. (Show Details)May 23 2024, 11:43 PM

Sgs set the point value for this task to 3.May 28 2024, 4:22 PM

KStoller-WMF moved this task from Estimated tasks backlog to Sprint 16 (Growth Team) on the Growth-Team board.Jun 11 2024, 4:47 PM

KStoller-WMF edited projects, added: Growth-Team (Sprint 16 (Growth Team)); removed: Growth-Team.

KStoller-WMF edited projects, added: Growth-Team; removed: Growth-Team (Sprint 16 (Growth Team)).Jun 11 2024, 8:26 PM

KStoller-WMF moved this task from Inbox to Triaged on the Growth-Team board.Jun 11 2024, 8:31 PM

kostajh closed subtask T357498: Temp account creations do not appear in Special:Log as Resolved.Jul 10 2024, 4:23 AM

@KColeman-WMF @Niharika this task needs design and product specification for what the Special:CreateAccount page should look like if you are logged-in as a temporary account user and want to create a full, named account. There is already a suggestion on what is to be done for this task:

In T328718#8739811, @Umherirrender wrote:

There is message "createacct-temp-warning" (The edits you made with your temporary account will not be carried over to your permanent one.), so only the temp password and the reason field should be removed and the auth process must not use the temp user to log

Umherirrender unsubscribed.Jul 19 2024, 10:13 PM

In T328718#8739811, @Umherirrender wrote:

There is message "createacct-temp-warning" (The edits you made with your temporary account will not be carried over to your permanent one.), so only the temp password and the reason field should be removed and the auth process must not use the temp user to log

@KColeman-WMF and I talked about this. We think this suggestion makes sense. I'll update the spec in the task.

• Niharika updated the task description. (Show Details)Jul 25 2024, 3:46 PM

Tchanders added a project: Trust and Safety Product Sprint (Sprint Koto (July 15 - July 26)).Jul 29 2024, 8:01 AM

Tchanders edited projects, added: Trust and Safety Product Sprint (Sprint Erhu (August 5th - August 16th)); removed: Trust and Safety Product Sprint (Sprint Koto (July 15 - July 26)).Aug 5 2024, 10:03 AM

Tchanders moved this task from Priority Backlog to Ready on the Trust and Safety Product Sprint (Sprint Erhu (August 5th - August 16th)) board.

Dreamy_Jazz moved this task from Sprint Erhu (August 5th - August 16th) to Sprint Theremin (Aug 26 - Sept. 6) on the Trust and Safety Product Sprint board.Aug 27 2024, 12:31 PM

Dreamy_Jazz edited projects, added: Trust and Safety Product Sprint (Sprint Theremin (Aug 26 - Sept. 6)); removed: Trust and Safety Product Sprint (Sprint Erhu (August 5th - August 16th)).

Dreamy_Jazz moved this task from Priority Backlog to Ready on the Trust and Safety Product Sprint (Sprint Theremin (Aug 26 - Sept. 6)) board.

• mszabo changed the task status from Open to In Progress.Aug 30 2024, 11:35 AM

• mszabo claimed this task.

Change #1069270 had a related patch set uploaded (by Máté Szabó; author: Máté Szabó):

[mediawiki/core@master] auth: Split TemporaryPasswordPrimaryAuthenticationProviderTest cases

https://gerrit.wikimedia.org/r/1069270

gerritbot added a project: Patch-For-Review.Aug 30 2024, 6:43 PM

Change #1070002 had a related patch set uploaded (by Máté Szabó; author: Máté Szabó):

[mediawiki/core@master] auth: Disable irrelevant account creation fields for temp users

https://gerrit.wikimedia.org/r/1070002

• mszabo moved this task from Ready to Needs review on the Trust and Safety Product Sprint (Sprint Theremin (Aug 26 - Sept. 6)) board.Sep 2 2024, 11:52 AM

Change #1069270 merged by jenkins-bot:

[mediawiki/core@master] auth: Split TemporaryPasswordPrimaryAuthenticationProviderTest cases

https://gerrit.wikimedia.org/r/1069270

ReleaseTaggerBot added a project: MW-1.43-notes (1.43.0-wmf.22; 2024-09-10).Sep 3 2024, 2:00 PM

Umherirrender unsubscribed.Sep 3 2024, 7:55 PM

kostajh moved this task from Needs review to Needs QA on the Trust and Safety Product Sprint (Sprint Theremin (Aug 26 - Sept. 6)) board.Sep 6 2024, 6:19 PM

kostajh moved this task from Needs QA to Needs review on the Trust and Safety Product Sprint (Sprint Theremin (Aug 26 - Sept. 6)) board.Sep 7 2024, 8:37 AM

zeljkofilipin added a project: User-zeljkofilipin.Sep 9 2024, 3:24 PM

zeljkofilipin moved this task from Backlog 🪒 to Deep work 🌊 on the User-zeljkofilipin board.

Change #1070002 merged by jenkins-bot:

[mediawiki/core@master] auth: Disable irrelevant account creation fields for temp users

https://gerrit.wikimedia.org/r/1070002

kostajh moved this task from Needs review to Needs QA on the Trust and Safety Product Sprint (Sprint Theremin (Aug 26 - Sept. 6)) board.Sep 10 2024, 8:08 PM

Maintenance_bot removed a project: Patch-For-Review.Sep 10 2024, 8:31 PM

ReleaseTaggerBot edited projects, added: MW-1.43-notes (1.43.0-wmf.23; 2024-09-17); removed: MW-1.43-notes (1.43.0-wmf.22; 2024-09-10).Sep 10 2024, 9:00 PM

QA has been completed and the new code is functioning and displaying as expected (Per the Acceptance Criteria: Show a specific version of Special:CreateAccount for temp accounts which does not ask for a rationale, and doesn't have the send a temp password to an email field).

Special:CreateAccount page (Before implementation of new code changes):