Change #1133144 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/WikimediaEvents@master] EmailAuth: Log privileges and recent activity

https://gerrit.wikimedia.org/r/1133144

whether the user has been active (on the current wiki; globally this seems hard)

I think we could use cuci_user which keeps track of CheckUser related activity.

In T391634#10733148, @kostajh wrote:

whether the user has been active (on the current wiki; globally this seems hard)

I think we could use cuci_user which keeps track of CheckUser related activity.

Although, I am not convinced that we should base the EmailAuth decision on user activity / inactivity. A user's level of activity doesn't help protect against credential stuffing attacks.

In T391634#10733148, @kostajh wrote:

I think we could use cuci_user which keeps track of CheckUser related activity.

Yeah that would work as long as we are fine with not being able to differentiate between people inactive in the last 90 days and people inactive for some longer period of time.

In T391634#10734428, @kostajh wrote:

I am not convinced that we should base the EmailAuth decision on user activity / inactivity. A user's level of activity doesn't help protect against credential stuffing attacks.

If you see a suspicious login from an inactive user, it's more likely to be an attack than a suspicious login from an active user.

Maybe it would make more sense as an alerting / rate limiting rule than an EmailAuth rule.

Change #1133144 merged by jenkins-bot:

[mediawiki/extensions/WikimediaEvents@master] EmailAuth: Log privileges and recent activity

https://gerrit.wikimedia.org/r/1133144