I thought we had a task for this already (the IPv6 /64 part at least) but can't find it.

I've seen at least one user stating that he's removed his email in order to avoid the verification codes which is the opposite of what's intended with the new security feature.

If you don't have an email address, you need to pass a captcha instead. Not sure if that's more convenient.

Thanks for updating the task! Just to make sure there's no misunderstanding: I was talking about the verification codes introduced by https://www.mediawiki.org/wiki/Help:Extension:EmailAuth – is that LoginNotify?

LoginNotify determines whether the IP is known. Other extensions including EmailAuth rely on it.

Hmm. It looks like LoginNotify::getIPNetwork is already supposed to be returning the /24 or /64 network, which is then used for constructing the hash that's stored in the loginnotify_seen_net table:

	/**
	 * Get just network part of an IP (assuming /24 or /64)
	 *
	 * It would be nice if we could use IPUtils::getSubnet(), which also gets
	 * the /24 or /64 network in support of a similar use case, but its
	 * behaviour is broken for IPv6 addresses, returning the hex range start
	 * rather than the prefix. (T344963)
	 *
	 * @param string $ip Either IPv4 or IPv6 address
	 * @return string Just the network part (e.g. 127.0.0.)
	 */
	private function getIPNetwork( $ip ) {

An IPv6 /64 is likely too small for most mobile providers -- they tend to be significantly more dynamic than that.

In T395838#10951810, @AntiCompositeNumber wrote:

An IPv6 /64 is likely too small for most mobile providers -- they tend to be significantly more dynamic than that.

Do you have a suggestion for what range we should consider for IPv6?

In T395838#10951898, @kostajh wrote:

In T395838#10951810, @AntiCompositeNumber wrote:

An IPv6 /64 is likely too small for most mobile providers -- they tend to be significantly more dynamic than that.

Do you have a suggestion for what range we should consider for IPv6?

Something between /40 and /44 is what I typically encounter when performing CU, that seems like a typical range size for many good faith editors as well.

Could also limit allowing a larger subnet to the case when the user has used several different /64s in the last three months.