the purpose is to correctly display their signature (or username) in preview, if they add one in the edit

Would it be feasible to fake this (e.g. return "Unregistered 123456"), rather than obtain an actual temporary user account?

Yes, the current implementation uses something like "Unregistered *" (with an asterisk instead of the auto-generated part) if you preview your signature without acquiring a name first.

I suppose we could, but that seems like a worse experience. It seemed important to me that at least DiscussionTools should display the real signature when previewing your comment. But we never asked any actual users how they feel about it, maybe they wouldn't care.

By the way, I think that adding rate limits is easier now than when I wrote this task (after T310476). Also, we already need to consider that acquiring the name might fail (it's already built into mw.user.acquireTempUserName), and generally in that case we don't need to do anything and just allow the API to display the placeholder.

If I just wrote a patch for that, would that be okay?

In T343101#9540803, @matmarex wrote:

I suppose we could, but that seems like a worse experience. It seemed important to me that at least DiscussionTools should display the real signature when previewing your comment. But we never asked any actual users how they feel about it, maybe they wouldn't care.

It doesn't seem like a big UX problem if the user sees a generic placeholder, but we could ask for more input about that. (cc @KColeman-WMF)

---

By the way, I think that adding rate limits is easier now than when I wrote this task (after T310476). Also, we already need to consider that acquiring the name might fail (it's already built into mw.user.acquireTempUserName), and generally in that case we don't need to do anything and just allow the API to display the placeholder.

If I just wrote a patch for that, would that be okay?

Sorry, can you clarify what you will write a patch for -- showing a generic placeholder if acquiring the temp name fails?

It's somewhat far-fetched, but it may be possible to abuse this mechanism if it's not limited

IMO it's fairly trivial to abuse, and I don't think we should expose an endpoint that generates writes to a DB table without a rate limit. I think we will need a rate limit that is a multiple of whatever we decide in T342880: Decide what the rate limit should be for temporary account creations.

That said, to limit complexity and mechanisms for abuse of temp accounts, I'm wondering what others think about disabling this API endpoint for now. The proposal would be:

• Set a feature flag or otherwise disable the API endpoint for acquiring a temp username
• Update mw.user.acquireTempUserName to return a generic placeholder, or add a new method like mw.user.getGenericTempUserPlaceholderName and update callers of mw.user.acquireTempUserName to use that
• Instrument mw.user.getGenericTempUserPlaceholderName so that we see what usage is like
• After temp accounts is in production and we are confident in our ability to limited scripted abuse, we could look at UX improvements like showing the real temp username that would be created, using rate limit informed by real world usage

In T343101#9541045, @kostajh wrote:

If I just wrote a patch for that, would that be okay?

Sorry, can you clarify what you will write a patch for -- showing a generic placeholder if acquiring the temp name fails?

I meant adding the rate limit. There is already support for a generic placeholder (implemented in https://gerrit.wikimedia.org/r/c/mediawiki/core/+/909380).

That said, to limit complexity and mechanisms for abuse of temp accounts, I'm wondering what others think about disabling this API endpoint for now. The proposal would be:

• Set a feature flag or otherwise disable the API endpoint for acquiring a temp username
• Update mw.user.acquireTempUserName to return a generic placeholder, or add a new method like mw.user.getGenericTempUserPlaceholderName and update callers of mw.user.acquireTempUserName to use that
• Instrument mw.user.getGenericTempUserPlaceholderName so that we see what usage is like
• After temp accounts is in production and we are confident in our ability to limited scripted abuse, we could look at UX improvements like showing the real temp username that would be created, using rate limit informed by real world usage

Sounds fair.

If you just want to "disable" the API temporarily without removing the code, it's even easier – just make action=acquiretempusername fail with an error. The client-side code in mw.user.acquireTempUserName can handle that already (you could skip the API request as an optimization), and all of its users can handle it as well (they don't actually use the username themselves – they just rely on the backend of action=parse etc. to know it, and it will use the generic placeholder in this case).

Change #1015269 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/core@master] TempAccounts: Rate limit acquisition of temp account names

https://gerrit.wikimedia.org/r/1015269

Change #1015318 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/SpamBlacklist@master] tests: Pass FauxRequest to TempUserCreator

https://gerrit.wikimedia.org/r/1015318

Change #1015325 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/CheckUser@master] tests: Pass FauxRequest to TempUserCreator

https://gerrit.wikimedia.org/r/1015325

Change #1015318 merged by jenkins-bot:

[mediawiki/extensions/SpamBlacklist@master] tests: Pass FauxRequest to TempUserCreator

https://gerrit.wikimedia.org/r/1015318

Change #1015325 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] Temporary Accounts: Pass WebRequest to TempUserCreator

https://gerrit.wikimedia.org/r/1015325

Change #1015269 merged by jenkins-bot:

[mediawiki/core@master] TempAccounts: Rate limit acquisition of temp account names

https://gerrit.wikimedia.org/r/1015269

Change #1023737 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/core@master] DevelopmentSettings: Disable rate limiting for temp accounts

https://gerrit.wikimedia.org/r/1023737

Change #1023737 merged by jenkins-bot:

[mediawiki/core@master] DevelopmentSettings: Disable rate limiting for temp accounts

https://gerrit.wikimedia.org/r/1023737

I have tested various settings for $wgTempAccountNameAcquisitionThrottle to see if it limits the number of temporary usernames the same IP can acquire within a time period. I have seen that the limit also applies across multiple, CentralAuth connected wikis.

Test environment: local docker MediaWiki 1.43.0-alpha (205892a) 01:48, 10 May 2024.