Beat me to it by 7 minutes.

There are several other proposals for verifying that the user is in mainland China:

• Ask Chinese users to verify their phone number through SMS to instantly gain IPBE, to prove that they are in China. At the same time, this also has the positive effect of preventing people in China from creating sockpuppet accounts. (Such a page would accept Chinese phone numbers only, as it is not necessary for people in other countries to verify their phone number.)
• Ask Chinese users to pay a token amount such as CNY￥0.01 (worth only a fifth of a Canadian cent) using Alipay or WeChat Pay in an automatic sign-up portal to gain IPBE. This is not to make money or collect donations, but to verify that they are in China. (One cent RMB is nothing and will cause absolutely no financial burden for editors, as Taobao gives out roughly 10-50 cents for free every day in their 一起摇现金 promotion, where the user can shake their phone daily and get this small amount deposited directly to their Alipay account.)

—Félix An, on the enwiki thread

I'm not confident the fact the portal doesn't directly host censored content will be convincing to whoever manages the Great firewall. VPNs and Tor don't directly host censored content, they grant access to it, and that's exactly what this portal would be doing. In addition, granting automatic IPBE to Chinese users seems like... not the greatest of ideas.

they grant access to it

The portal doesn't grant access to it, user's VPN does, the portal just grant EDIT ability to it.

Plus, I'm not sure what your concern with automatically granting IPBE to mainlanders is. They physically cannot edit without it and there are existing measures against disruptive edits. There is 1 billion people in China and this would bring a great influx of these intelligent enough to use a VPN

If we were to do this:

1. The "portal" should have a separate domain (or use toolforge.org which hasn't been blocked, yet), the domain should not (edited) contain the keyword "wikipedia" (a mirror site operator reported that URL's with the keyword is likely to be disturbed).
2. There should be CAPTCHA
3. There should be sysops to prevent mass-creating and LTA, and block open proxies.
4. Some communities should alter the local policies to grant IPBE in this way.

[...] granting automatic IPBE to Chinese users seems like... not the greatest of ideas

That is what we have been doing, only by hand instead of sign-up portals. Some just gets their IPBE and never edit since; some comes for advertising and was blocked indef. But what else could we do? At least some stays and contributes.

block open proxies

Isn't this all about granting automatic IPBE for open proxies' users from China?

The "portal" should have a separate domain

The original enwiki details include putting the portal on a shifting IP address instead of a domain.

Isn't this all about granting automatic IPBE for open proxies' users from China?

The verification process relys on the user's real IP.

The original enwiki details include putting the portal on a shifting IP address instead of a domain.

I don't know. Am not a tech guy. IP is cool.

Alright, so I take it you meant Chinese open proxies? That would be quite a task and indeed something we need to consider

the sign-up portal would contain no articles to avoid upsetting the censors, causing the portal to be blocked), with the IP changing frequently to avoid blocking

So it is just an another cat-and-mouse game, like official mirror website and VPN etc.

Alright, I’m convinced. In terms of how this would be done technically, I think that it could potentially be made entirely on Toolforge. The portal could validate the IP address and then create an account with IPBE with a bot account. Is there an interface page that appears on Special:CreateAccount? We could link to the portal through that.

This, of course, runs the risk of getting Toolforge blocked, but I don’t think this would be a major issue as it is only used by contributors.

@SCP-2000

So it is just an another cat-and-mouse game, like official mirror website and VPN etc.

Not really, like Wikimedia Commons, Wiktionary, Wikivoyage, which is not blocked since long ago, the portal website has no content offending CCP, and will also not has them in any future. So it hopefully will not be blocked.

We at least should try censor's red line once.

I've found the system message, it's MediaWiki:Signupstart. So that could be used. Before continuing, there should probably be some sort of consensus on zhwiki for this.

Yes, at least consensus must be reached on zhwiki. Also, maybe we need a meta RfC to gather information from Iran and other countries. Plus, auto granting IPBE's may affect how stewards handle GIPBE requests, so it's, in a way, a global issue.

I think we should trial this on one language for now. If it works out well, we can bring it elsewhere. And I'm not sure how this affects GIPBE. Would any of the subscribed stewards like to comment on that?

If you have local IPBE you won't be locally impacted by a global block. You will still be impacted elsewhere, such as a commonswiki and wikidatawiki if they are also blocking you.

And I'm not sure how this affects GIPBE.

Just guessing. Maybe a steward would see someone with lots of IPBE's and think, wow, this must be a trusted user ;)

In T336882#8861039, @ZauberViolino wrote:

Isn't this all about granting automatic IPBE for open proxies' users from China?

The verification process relys on the user's real IP.

The original enwiki details include putting the portal on a shifting IP address instead of a domain.

I don't know. Am not a tech guy. IP is cool.

*It counts as repetition
At the same time, it will bring privacy concerns, and law enforcement agencies (such as Ministry of State Security (China) aka MSS) can more easily trace users through money transfer methods and SMS
Of course, IP addresses can also be traced
I think the PRC Government will definitely want these privacy more after OA21(2021 Wikimedia Foundation actions on the Chinese Wikipedia)

The gateway would be the best in avoiding law enforcement. For the money transfer method, we could find a generic international money-transferring service that doesn't display the company name in the transaction name.

Some thoughts:

1. It's not promising to rely on censorable but not yet censored platform (like Toolforge). We should use censorship-resistant platforms, typically to rely on large entities which government cannot easily block. (See also T327286)
2. We should find a balance between security/privacy/anonymity and convenience. Use as less custom software as possible. The more complex the procedure is, the less a user will be willing to join. Anything involves money transfer should be avoided.
3. Such portal may collect sensitive personal information. Does WMF privacy policy apply here? Which platform will it run on? I think this needs wider discussion.

The WMF privacy policy doesn't apply, but the WMCS privacy policy does, although it's not as strictly enforced.

Wikitech (which I'm pretty sure is WMCS) links "Privacy Policy" to the WMF privacy policy.

Some volunteers (including me) are concerned about the anti-vandalism issue, Is it possible for this kind of system to allocate administrators to confront abuse? Stewards and CUers(? no CUers on zhwiki haha) should have the ability to check if an IP (range) is abused and block it if necessary. Just think about those sensitive data...

Vandalism amounts shouldn't increase much, this is just automating a system that stewards have been manually doing for a while. I know this because it's how I first started editing Wikipedia.

I hope WMF can participate in this project with the community since such a portal is hard to maintain solely by the community itself.

The discussion on zhwiki was archived (here) with no consensus. Major oppositions include security issuses of the portal and its users.

One of the core principles we follow these days is collateral damage. That is, we assume the GFW won't cut the Internet in whole since it is essential for academic research, foreign trades and so on. Certain kinds of websites, such as education institutes, libraries, statistics websites and academic websites are exempted from blocking in general.

Would it be possible for the WMF to partner with public libraries and colleges to host portal pages under their domains? Such portals are "politically" safe to access and immune to censorship. IPBE granted here can be ephemeral or short-time to counter abuse since it is trivial for users to re-verify.

In T336882#9425605, @Hoi wrote:

One of the core principles we follow these days is collateral damage. That is, we assume the GFW won't cut the Internet in whole since it is essential for academic research, foreign trades and so on. Certain kinds of websites, such as education institutes, libraries, statistics websites and academic websites are exempted from blocking in general.

Would it be possible for the WMF to partner with public libraries and colleges to host portal pages under their domains? Such portals are "politically" safe to access and immune to censorship. IPBE granted here can be ephemeral or short-time to counter abuse since it is trivial for users to re-verify.

It should be discussed with the local community and reach consensus first. However, according to the discussion mentioned by ZauberViolino, it seems there has been no consensus yet. Thanks.