Page MenuHomePhabricator
Create Task
Maniphest T357776

[Epic] Mitigate abilities to abuse temporary accounts
Open, Needs TriagePublic
Actions

Description

The goal of this epic is to mitigate abilities for bad faith users to abuse the temporary account creation mechanism, and temporary accounts in general. Details are in subtasks.

Related Objects
Search...

StatusSubtypeAssignedTask
Restricted Task
 ResolvedkostajhT294511 2021 Security Team wikireplicas audit
 DeclinedNoneT284948 Raw IPs of logged-out users disclosed in wiki-replicas
 ResolvedNiharikaT324492 Temporary accounts - MVP
 OpenkostajhT357776 [Epic] Mitigate abilities to abuse temporary accounts
 ResolvedkostajhT357777 Implement more restrictive rate limit for temporary account creation
 ResolvedkostajhT342880 Decide what the rate limit should be for temporary account creations
 ResolvedjwangT357771 Analyze how many distinct devices edit per day from a given IP address
 DeclinedkostajhT359194 Instrument potential temporary account creations
 ResolvedkostajhT357778 Provide ability to require logged-out users to complete a CAPTCHA on temporary account creations in certain circumstances
 ResolvedkostajhT357779 Provide ability to require temporary account users to complete a CAPTCHA in certain circumstances
 DeclinedNoneT357782 Place temporary blocks on temporary account creation for IPs with high rate of reverts
 ResolvedAAlhazwani-WMFT357802 Design & Copy: Prompt user to create a regular account after temp account creation rate limit trip
 ResolvedAAlhazwani-WMFT408011 Design Research: Prompt user to create a regular account after temp account creation rate limit trip
 Resolved• mszaboT364705 Provide AbuseFilter condition for revertrisk threshold
 ResolvedachouT356102 Allow calling revertrisk language agnostic and revert risk multilingual APIs in a pre-save context
 Resolved• Dreamy_JazzT354599 [EPIC] WE4.2.14b Provide IP reputation variables in AbuseFilter
 ResolvedkostajhT360067 Deploy Extension:IPReputation
 ResolvedsbassettT360070 Application Security Review Request : Extension:IPReputation
 Duplicate• Dreamy_JazzT380454 Provide ip_reputation_tunnel_operators AbuseFilter
 DuplicateSTranT380919 Don't funnel all protected variable access logs to CheckUser temporary account access log
 ResolvedSTranT381052 Investigate: Should we remove the preference check from AbuseFilter's protected variables implementation?
 Duplicate• Dreamy_JazzT380710 Provide ip_reputation_risk_types variable in AbuseFilter
 Resolved• Dreamy_JazzT386913 IPReputation: Create a service to get IPoid data in IPReputation
 Resolved• Dreamy_JazzT380918 Provide capability to define new protected variables from other extensions
 ResolvedSTranT385687 Investigate: How should the AbuseFilter variable `user_unnamed_ip` be restricted
 Resolved• Dreamy_JazzT380920 Remove the AbuseFilter protected variables preference gate
 Resolved• Dreamy_JazzT387333 CheckUser should impose IP viewing restrictions on AbuseFilter's `unnamed_user_ip` protected variable
 Resolved• Dreamy_JazzT387331 Provide a mechanism for other extensions to modify protected variables access requirements
 Resolved• Dreamy_JazzT387013 IPReputation: Add AbuseFilter dependency in CI and Phan
 ResolvedSTranT387324 Add hook to support custom logging in `ProtectedVarsAccessLogger`
 ResolvedSTranT387328 Refactor CheckUser ProtectedVarsAccessLogger logging out of AbuseFilter
 ResolvedSTranT387329 Investigate: Confirm our logging expectations for AbuseFilter/CheckUser Temporary Accounts logs when using protected variables
 Resolved• Dreamy_JazzT390873 AbuseFilter protected variables: Make it possible for protected variable values expire when the IP address expires
 Resolved• Dreamy_JazzT390874 IPReputation: Create the initial IPReputation AbuseFilter variables
 Resolved• Dreamy_JazzT388781 AbuseFilter / IP reputation: Instrument latency
 Resolved• Dreamy_JazzT393665 AbuseFilter IP reputation: Provide documentation and recommendations for usage
 Resolved• Dreamy_JazzT396069 Support generation of IPReputation AbuseFilter variable data for previous actions
 Resolved• Dreamy_JazzT396079 Support generation of IPReputation AbuseFilter variables for temporary accounts and account creation
 ResolvedSecurity• Dreamy_JazzT396750 CVE-2025-53495: Do not show IP Reputation AbuseFilter variables to those without permission in Special:AbuseFilter/examine/<rc id>
 ResolvedSecurity• Dreamy_JazzT397196 CVE-2025-53499: AbuseFilter 'abusefiltercheckmatch' API does not check protected variable access restrictions
 ResolvedSecurity• Dreamy_JazzT397221 CVE-2025-53498: AbuseFilter batch testing tool do not log when protected variables are in the test pattern
 OpenNoneT364710 Create AbuseFilter condition for "likely a bot"
 Resolved• MunizaAT352839 RevertRisk model readiness for temporary accounts
 ResolvedSamwalton9-WMFT374920 Coordinate AutoModerator rollout with pilot wiki deployments
 ResolvedSTranT405565 Throttle temporary account creation

Event Timeline

kostajh created this task.Feb 16 2024, 2:15 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptFeb 16 2024, 2:15 PM
kostajh renamed this task from [Epic] Mitigate abilities to abuse temporary accounts, and minimize administrative burden in cleaning up temp account abuse to [Epic] Mitigate abilities to abuse temporary account creation.Feb 16 2024, 2:41 PM
kostajh updated the task description. (Show Details)
kostajh mentioned this in T342880: Decide what the rate limit should be for temporary account creations.Feb 16 2024, 2:58 PM
Tgr subscribed.Feb 16 2024, 3:47 PM
JJMC89 added a project: Epic.Feb 16 2024, 3:48 PM
kostajh claimed this task.Mar 3 2024, 7:47 PM
kostajh closed subtask T357777: Implement more restrictive rate limit for temporary account creation as Resolved.Mar 18 2024, 9:59 AM
kostajh mentioned this in T356102: Allow calling revertrisk language agnostic and revert risk multilingual APIs in a pre-save context.May 10 2024, 1:40 PM
kostajh added a subtask: T364705: Provide AbuseFilter condition for revertrisk threshold.May 13 2024, 7:38 AM
kostajh added a subtask: T354599: [EPIC] WE4.2.14b Provide IP reputation variables in AbuseFilter.May 13 2024, 7:41 AM
kostajh changed the status of subtask T364705: Provide AbuseFilter condition for revertrisk threshold from Open to Stalled.Jun 28 2024, 2:16 PM
kostajh changed the status of subtask T354599: [EPIC] WE4.2.14b Provide IP reputation variables in AbuseFilter from Open to Stalled.
kostajh changed the status of subtask T364705: Provide AbuseFilter condition for revertrisk threshold from Stalled to Open.Jul 2 2024, 12:30 PM
kostajh edited projects, added Temporary accounts (Create/update essential tools/anti-abuse management); removed Temporary accounts.Jul 3 2024, 10:11 AM
kostajh changed the status of subtask T357779: Provide ability to require temporary account users to complete a CAPTCHA in certain circumstances from Open to Stalled.Jul 12 2024, 6:35 PM
kostajh changed the status of subtask T357779: Provide ability to require temporary account users to complete a CAPTCHA in certain circumstances from Stalled to Open.Aug 26 2024, 12:27 PM
kostajh closed subtask T357779: Provide ability to require temporary account users to complete a CAPTCHA in certain circumstances as Resolved.Aug 27 2024, 9:56 AM
kostajh closed subtask T357782: Place temporary blocks on temporary account creation for IPs with high rate of reverts as Declined.Aug 27 2024, 11:49 AM
kostajh closed subtask T357778: Provide ability to require logged-out users to complete a CAPTCHA on temporary account creations in certain circumstances as Resolved.
kostajh added a subtask: T364710: Create AbuseFilter condition for "likely a bot".Sep 13 2024, 10:53 AM
kostajh renamed this task from [Epic] Mitigate abilities to abuse temporary account creation to [Epic] Mitigate abilities to abuse temporary account.Sep 17 2024, 9:53 AM
kostajh renamed this task from [Epic] Mitigate abilities to abuse temporary account to [Epic] Mitigate abilities to abuse temporary accounts.
kostajh added a subtask: T352839: RevertRisk model readiness for temporary accounts.
kostajh updated the task description. (Show Details)
kostajh changed the status of subtask T354599: [EPIC] WE4.2.14b Provide IP reputation variables in AbuseFilter from Stalled to Open.Nov 21 2024, 10:21 AM
kostajh removed kostajh as the assignee of this task.Dec 11 2024, 3:28 PM
Titore subscribed.Mar 10 2025, 1:04 AM
• mszabo changed the status of subtask T364705: Provide AbuseFilter condition for revertrisk threshold from Open to In Progress.Jun 2 2025, 4:25 PM
• Dreamy_Jazz closed subtask T354599: [EPIC] WE4.2.14b Provide IP reputation variables in AbuseFilter as Resolved.Jun 23 2025, 5:03 PM
kostajh closed subtask T364705: Provide AbuseFilter condition for revertrisk threshold as Resolved.Sep 30 2025, 12:23 PM
kostajh claimed this task.Oct 10 2025, 8:45 AM
sgrabarczuk added a subtask: T405565: Throttle temporary account creation.Oct 13 2025, 2:25 PM
Johannnes89 subscribed.Oct 13 2025, 6:52 PM
STran closed subtask T405565: Throttle temporary account creation as Resolved.Nov 7 2025, 4:27 PM
KStoller-WMF closed subtask T357802: Design & Copy: Prompt user to create a regular account after temp account creation rate limit trip as Resolved.Tue, Nov 18, 2:30 PM
Samwalton9-WMF closed subtask T374920: Coordinate AutoModerator rollout with pilot wiki deployments as Resolved.Fri, Dec 5, 3:08 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits