Do not show link between named account and temporary account in RecentChanges and Special:Log
Closed, ResolvedPublic1 Estimated Story Points
Actions

Assigned To

Authored By

	kostajh
	May 13 2024, 8:42 AM

Description

Context

We create temporary accounts to protect user privacy. Temp account users can create permanent accounts. We inform temp account users that their edit history is not carried over to the named account. My expectation then is that temp account users would expect to not see a public link between the temporary account and their named account.

But in RecentChanges and in Special:Log, anyone can see that the new named account was created by a specific temp account.

Proposal

Don't show the "created by" part in Special:Log, RecentChanges, etc

Consequences

It is harder for someone to guess at which permanent, named account is associated with a particular temporary account

Details

	Subject	Repo	Branch	Lines +/-
	Don't link temporary account and named account in newusers log	mediawiki/core	master	+3 -3

Customize query in gerrit

Related Objects
Search...

Status	Assigned	Task
		Restricted Task
Resolved	kostajh	T294511 2021 Security Team wikireplicas audit
Declined	None	T284948 Raw IPs of logged-out users disclosed in wiki-replicas
In Progress	Niharika	T324492 Temporary accounts - MVP
Open	Niharika	T340001 [Epic] Deployment plan for Temporary Accounts
Resolved	Niharika	T348895 [Epic] Temporary accounts testwiki deployment
Resolved	Dreamy_Jazz	T364716 Do not show link between named account and temporary account in RecentChanges and Special:Log

Event Timeline

kostajh created this task.May 13 2024, 8:42 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMay 13 2024, 8:42 AM

kostajh renamed this task from Do not show link between named account and temporary account in RecentChanges to Do not show link between named account and temporary account in RecentChanges and Special:Log.May 13 2024, 9:03 AM

kostajh added a parent task: T348895: [Epic] Temporary accounts testwiki deployment.

One point to consider: T335508#9544992

JJMC89 added a project: MediaWiki-User-login-and-signup.May 13 2024, 3:08 PM

kostajh mentioned this in T357498: Temp account creations do not appear in Special:Log.May 21 2024, 1:39 PM

kostajh mentioned this in T328718: [IP Masking] Do not show logged-in version of Special:CreateAccount page to temp accounts.May 21 2024, 1:43 PM

KStoller-WMF moved this task from Inbox to Up Next on the Growth-Team board.May 23 2024, 4:24 PM

KStoller-WMF triaged this task as High priority.May 23 2024, 4:33 PM

Michael subscribed.May 27 2024, 5:10 PM

@kostajh I wanted to confirm if TSP intended on working on this task? We were discussing it today but wanted to clarify before we considered investigating this.

In T364716#9835797, @DMburugu wrote:

@kostajh I wanted to confirm if TSP intended on working on this task? We were discussing it today but wanted to clarify before we considered investigating this.

If Growth has capacity to work on this, that would be great.

We're currently focused getting through a couple of issues that are critical to us deploying Community Configuration to our first pilot wiki. I suspect that we may have some bandwidth after we deploy Community Configuration to a pilot wiki(~ 1.5 sprints from today which is in 3 weeks) to launch an initial investigation into this.

Can the task wait until then since it's been tagged as a high priority?

In T364716#9837449, @DMburugu wrote:

We're currently focused getting through a couple of issues that are critical to us deploying Community Configuration to our first pilot wiki. I suspect that we may have some bandwidth after we deploy Community Configuration to a pilot wiki(~ 1.5 sprints from today which is in 3 weeks) to launch an initial investigation into this.

Can the task wait until then since it's been tagged as a high priority?

That sounds OK to me (cc @Tchanders)

In T364716#9837499, @kostajh wrote:

In T364716#9837449, @DMburugu wrote:

We're currently focused getting through a couple of issues that are critical to us deploying Community Configuration to our first pilot wiki. I suspect that we may have some bandwidth after we deploy Community Configuration to a pilot wiki(~ 1.5 sprints from today which is in 3 weeks) to launch an initial investigation into this.

Can the task wait until then since it's been tagged as a high priority?

That sounds OK to me (cc @Tchanders)

Sounds reasonable, thanks @DMburugu. Note that I think this would be a blocker to testwiki deployment though, since it could make IP addresses of registered accounts more discoverable.

Tagging @TAdeleye_WMF who is keeping track of different teams' work schedules.

Sgs set the point value for this task to 1.May 28 2024, 4:26 PM

Tchanders moved this task from Inbox to Needs Other Teams on the Temporary accounts board.Jun 4 2024, 12:58 PM

KStoller-WMF added a project: Moderator-Tools-Team.Jun 5 2024, 4:44 PM

Scardenasmolinar moved this task from Inbox to Triaged on the Moderator-Tools-Team board.Jun 6 2024, 7:52 PM

KStoller-WMF moved this task from Up Next to Triaged on the Growth-Team board.Jun 11 2024, 8:31 PM

Change #1047952 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/core@master] Don't link temporary account and named account in newusers log

https://gerrit.wikimedia.org/r/1047952

gerritbot added a project: Patch-For-Review.Jun 20 2024, 11:27 AM

Testing notes

Enable temp users
As a logged out user, make an edit, creating a temp user
As that temp user, visit Special:CreateAccount
Create a new account
Visit Special:Log?type=newusers

Before this task, the log entry for the new account says it was created by the temp user.

Now, it should just say the the account was created, without mentioning who created it.

Change #1047952 merged by jenkins-bot:

[mediawiki/core@master] Don't link temporary account and named account in newusers log

https://gerrit.wikimedia.org/r/1047952

Maintenance_bot removed a project: Patch-For-Review.Jun 21 2024, 10:31 AM

ReleaseTaggerBot added a project: MW-1.43-notes (1.43.0-wmf.11; 2024-06-25).Jun 21 2024, 11:00 AM

kostajh moved this task from Priority Backlog to Needs QA on the Trust and Safety Product Sprint (Sprint Cajon (Jun 24 - July 5)) board.Jun 24 2024, 12:12 PM

I have verified the new code has been implemented and is functioning and displaying as expected.

Dreamy_Jazz closed this task as Resolved.Jun 26 2024, 8:17 AM

Dreamy_Jazz claimed this task.

Tchanders mentioned this in T370083: On Special:Log, IP reveal fails if the temp user is the not the performer of the log.Jul 15 2024, 5:13 PM

Dreamy_Jazz mentioned this in T123114: CheckUser stores two rows for account creations on WMF wikis.Jul 24 2024, 4:57 PM

	F55884801: image.png
	Jun 26 2024, 2:39 AM

	F55884790: image.png
	Jun 26 2024, 2:39 AM

	F55884774: image.png
	Jun 26 2024, 2:39 AM

	F55885049: image.png
	Jun 26 2024, 2:39 AM

Do not show link between named account and temporary account in RecentChanges and Special:LogClosed, ResolvedPublic1 Estimated Story PointsActions