• link to mw:Help:EmailAuth exists

Neither https://www.mediawiki.org/wiki/Help:EmailAuth or https://www.mediawiki.org/wiki/Help:Extension:EmailAuth currently exists - does user-facing documentation for this extension need to be created? (Or am I missing somewhere it’s currently written? :D)

In T390684#10698116, @A_smart_kitten wrote:

• link to mw:Help:EmailAuth exists

Neither https://www.mediawiki.org/wiki/Help:EmailAuth or https://www.mediawiki.org/wiki/Help:Extension:EmailAuth currently exists - does user-facing documentation for this extension need to be created? (Or am I missing somewhere it’s currently written? :D)

Tracked in T390657: Documentation: Create and link to https://www.mediawiki.org/wiki/Help:Extension:EmailAuth :) help welcome!

In T390684#10698233, @kostajh wrote:

In T390684#10698116, @A_smart_kitten wrote:

• link to mw:Help:EmailAuth exists

Neither https://www.mediawiki.org/wiki/Help:EmailAuth or https://www.mediawiki.org/wiki/Help:Extension:EmailAuth currently exists - does user-facing documentation for this extension need to be created? (Or am I missing somewhere it’s currently written? :D)

Tracked in T390657: Documentation: Create and link to https://www.mediawiki.org/wiki/Help:Extension:EmailAuth :) help welcome!

Thanks for the pointer! Boldly subtasking as it’s listed in this task’s acceptance criteria.

FWIW this is the current messaging:

• Login form message: You need to verify your login. A verification code has been sent to your email address (<address>), please enter that code here.
• Form field label: Verification code
• Email subject: Your login verification code to <site name>
• Email body: Your login verification code to <site name> is <code>

Ideally the email would

• warn that the token needs to be used quickly ("This token will be valid for 10 minutes" or similar, have seen other sites do that too)
• give some pointers on what to do if you didn't request the code and suspect someone is trying to hack you (other sites usually send you to some sort of customer service; not sure T&S has the resources for that)
• maybe mention setting up 2FA if it's installed and the user has the right to it

If anyone has similar emails from other large websites lying around, getting some screenshots from those would be a good start.

This is the Dutch version of a verification code email to set a recovery account in Google that i happened to receive this weekend.

Subject: E-mail met verificatiecode: 548326

Verifying your recovery email address

Google has received a request to set .. as the recovery email address for Google account ...

Use this code to complete configuring this as the recovery mail address

Code

This code expires in 24 hours.

If you do not recognize ... you can ignore this email.

Similar screenshots for Jetbrains and Slack

Here's one from The Guardian:

Should probably also mention the username since people might have many accounts with the same email address, and if the email is because of an attack, it's important to know which account is being attacked. The username is used in the To: field, but that's not very obvious.

Would it be possible to get a screenshot of what the current verification UX/email looks like? Thanks!

(The message about the new domain is something English Wikipedia's administrators have set up, it's not related to EmailAuth.)

Here's a proposal:

generated via P75507

@Tgr @KColeman-WMF how does this look?

Looks sensible.

FWIW sitename is something like "Wikipedia" (rather than "English Wikipedia"). I don't think the site where the user is logging in is important, just noting.

(That makes me wonder. This emails are in the site language, right? Since they are sent just before login. We should probably force usingthe language from the user's preference. How does e.g. LoginNotify do that? Do you get that kind of behavior with Echo for free?)

"10 minutes" could be calculated from the actual configuration settings (on Wikimedia wikis it's actually one day right now).

Change #1139155 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/EmailAuth@master] Add link to help page in email text and form text

https://gerrit.wikimedia.org/r/1139155

In T390684#10771658, @Tgr wrote:

Looks sensible.

FWIW sitename is something like "Wikipedia" (rather than "English Wikipedia"). I don't think the site where the user is logging in is important, just noting.

Ack. I think it's fine if it just says "Wikipedia".

(That makes me wonder. This emails are in the site language, right? Since they are sent just before login. We should probably force usingthe language from the user's preference. How does e.g. LoginNotify do that? Do you get that kind of behavior with Echo for free?)

I'm not sure. But we could make that into a separate task.

"10 minutes" could be calculated from the actual configuration settings (on Wikimedia wikis it's actually one day right now).

Sure. We could do $1 minutes if we want to base it on the configuration, that will just be awkward from a UX point of view, in the event that a site administrator wants to set a limit higher than 60 minutes.

Also noting that P75507 doesn't offer any suggestions for what to do if the user receiving the email wasn't the person attempting the login. Some sites (e.g. Amazon) provide some guidance on what to do there. I think it's better if we include those details in the help link, though, to keep the message as brief as possible.

Question — do we want to allow individual wikis to override/customise the EmailAuth help page link, e.g. in case they write their own help page about it that's more specific to that wiki?

In T390684#10771724, @A_smart_kitten wrote:

Question — do we want to allow individual wikis to override/customise the EmailAuth help page link, e.g. in case they write their own help page about it that's more specific to that wiki?

I think if non-WMF wiki maintainers say they'd need that, we could discuss supporting it, but otherwise I would prefer to avoid the extra work needed for that.

In T390684#10771988, @kostajh wrote:

In T390684#10771724, @A_smart_kitten wrote:

Question — do we want to allow individual wikis to override/customise the EmailAuth help page link, e.g. in case they write their own help page about it that's more specific to that wiki?

I think if non-WMF wiki maintainers say they'd need that, we could discuss supporting it, but otherwise I would prefer to avoid the extra work needed for that.

Also, the onEmailAuthRequireToken hook supports modifying the message, so a local wiki maintainer can add any message they like there.

It's a trivial change though, we might as well do it (unless we specifically want to discourage changing the target of the link on Wikimedia wikis, in which case we should probably disable local changes). Enwiki at least tends to create its own version of mediawiki.org documentation pages, and in the long term they are often better maintained and more informative.

Note though that login is global, so which wiki's version of the message you get is basically up to the attacker.

In T390684#10772350, @Tgr wrote:

unless we specifically want to discourage changing the target of the link on Wikimedia wikis, in which case we should probably disable local changes

Thinking more about this, I think changing the link is not a big deal, but changing the email text in general should be restricted (either via $wgRawHtmlMessages or Message::useDatabase()). Otherwise an attacker who already has interface-editor access (e.g. admin, not that hard to obtain) on some small wiki could use that wiki for login, and change the message to exfiltrate the code in some way (especially in the HTML version, one could embed a tracking pixel from a website under the attacker's control and put the code in the URL, but even for plain text, it could be part of a misleading link, or say something like "this is a test, please forward to attacker@evil.com").

In T390684#10771648, @kostajh wrote:

Here's a proposal:

generated via P75507

@Tgr @KColeman-WMF how does this look?

Thanks @kostajh!

I think this is a lot clearer and just have one suggestion:

Add a sentence to explain what to do with the code. E.g. Enter your verification code to login and secure your account.

I agree that we should ideally send the email in the language from the user's preferences and that we should restrict changes to the email text.

FWIW here's the message from Steam:

Your Steam account: Access from new web or mobile device

== {USERNAME}, ==

It looks like you are trying to log in from a new device. Here is the Steam Guard code you need to access your account:

Request made from
{COUNTRY}
{CODE}

== If this wasn't you ==

This email was sent because someone attempted to log in to your Steam account. The login attempt included your correct account name and password.

If you are not trying to log in, we recommend that you reset your Steam password.

The login code contained in this email is required to access your account. Do not share this code with anyone.

== Don't live in {COUNTRY}? ==

If you do not recognize the location above, you may be trying to log in to a fake Steam website. Please verify your location before continuing.

	
Cheers,
The Steam Team

I quite like it, I think it does a better job of not scaring the user too much and explaining what's going on.

In T390684#10786568, @Tgr wrote:

FWIW here's the message from Steam:

Your Steam account: Access from new web or mobile device

== {USERNAME}, ==

It looks like you are trying to log in from a new device. Here is the Steam Guard code you need to access your account:

Request made from
{COUNTRY}
{CODE}

== If this wasn't you ==

This email was sent because someone attempted to log in to your Steam account. The login attempt included your correct account name and password.

If you are not trying to log in, we recommend that you reset your Steam password.

The login code contained in this email is required to access your account. Do not share this code with anyone.

== Don't live in {COUNTRY}? ==

If you do not recognize the location above, you may be trying to log in to a fake Steam website. Please verify your location before continuing.

	
Cheers,
The Steam Team

I quite like it, I think it does a better job of not scaring the user too much and explaining what's going on.

That looks good to me as well, but perhaps we should not include links, to avoid phishing emails?

Either way, anything would be an improvement over what we have now, so whether it is the proposal in T390684#10774852 or T390684#10786568, let's move something forward.

@EMill-WMF @KColeman-WMF what do you think?

Here's a slightly updated proposal.

(Subject: Your {SITENAME} login verification code)

{USERNAME}, someone who knows your password is attempting to sign into your account on {SITENAME}.

Your verification code is:

{CODE}

This code is required to access your account. It will expire in {DURATION}. For your security, do not share it with anyone.

(more information)[<-- this is a link to the help page]

In T390684#10786656, @Tgr wrote:

Here's a slightly updated proposal.

(Subject: Your {SITENAME} login verification code)

{USERNAME}, someone who knows your password is attempting to sign into your account on {SITENAME}.

Your verification code is:

{CODE}

This code is required to access your account. It will expire in {DURATION}. For your security, do not share it with anyone.

(more information)[<-- this is a link to the help page]

I like this updated version. It makes it clear that they need the code to access their account. 👍

In T390684#10786656, @Tgr wrote:

{USERNAME}, someone who knows your password is attempting to sign into your account on {SITENAME}.

As 'someone' who has helped their family with questions about emails like this... This might make it seem that someone else actually has your password even though you are the one logging in. I actually had to explain this to a family member at some point, who figured they got hacked due to phrasing like this, even though they were the person logging in 2 minutes earlier...

Maybe.. "You, or someone who knows your password" ?

After some off-Phabricator discussion, we arrived at this:

(Subject: Your {SITENAME} login verification code)

{USERNAME}, It looks like you are trying to log in from a new device on {SITENAME}.

Your verification code is:

{CODE}

This code is required to access your account. It will expire in {DURATION}. For your security, do not share it with anyone.

== If you did not attempt to login to {SITENAME} ==

This email was sent because someone attempted to log in to your account. The login attempt included your correct account name and password.

If you are not trying to log in, we recommend that you change your password.

For more information see https://www.mediawiki.org/wiki/Special:MyLanguage/Help:Extension:EmailAuth

Change #1139155 merged by jenkins-bot:

[mediawiki/extensions/EmailAuth@master] Improve email contents

https://gerrit.wikimedia.org/r/1139155