How is adding more clicks to change your password a better user experience? Also, providing MW users navigation instructions on changing their password will also be more complicated since you must know if the extension is installed on their wiki.

UX aside, an extension hijacking/replacing the change password button sounds like a bad idea.

Change #1180185 had a related patch set uploaded (by Jly; author: Jly):

[mediawiki/extensions/OATHAuth@master] Rename Special:OATHAuth to Special:AccountSecurity for en and zh

https://gerrit.wikimedia.org/r/1180185

Test wiki created on Patch demo by JLy-WMF using patch(es) linked to this task:
https://6de3f379ca.catalyst.wmcloud.org/w/

In T401771#11087181, @JJMC89 wrote:

providing MW users navigation instructions on changing their password will also be more complicated since you must know if the extension is installed on their wiki.

Special:ChangePassword would still work, providing a direct link to that is simpler anyway then asking users to navigate the bloated preferences page.

UX aside, an extension hijacking/replacing the change password button sounds like a bad idea.

One potential issue is how it would interact with another extension that replaces passwords with something else (say GoogleLogin) and that might also result in the password section being removed.

It's a bit more work but what do you think about adding a Special:AccountSecurity page to core, with some mechanism for extensions to add form blocks to it?

There are two obscure and very minimalistic special pages already, Special:ChangeCredentials and Special:RemoveCredentials, it would be nice to replace them with something that doesn't look like it's from the early 2000s edition of PhpBB.

The tricky part is that the set of credentials that can be added / changed / removed is managed via extensions. There's not guarantee the wiki has passwords; but it could also have multiple kinds of passwords. It could use passkeys for login. The login and signup forms are generated from data provided by extensions in a flexible manner; we don't have a similar mechanism for credentials change, but we probably should.

Rename Special:OATHAuth to Special:AccountSecurity

Probably better (especially as a short-term solution) to keep Special:OATHAuth as is but don't link to it from preferences and have Special:AccountSecurity act as a sort of interstitial?

In T401771#11099967, @Tgr wrote:

It's a bit more work but what do you think about adding a Special:AccountSecurity page to core, with some mechanism for extensions to add form blocks to it?

I like that idea, that would then avoid the need to mess with the preferences page from the extension.

There are two obscure and very minimalistic special pages already, Special:ChangeCredentials and Special:RemoveCredentials, it would be nice to replace them with something that doesn't look like it's from the early 2000s edition of PhpBB.

The tricky part is that the set of credentials that can be added / changed / removed is managed via extensions. There's not guarantee the wiki has passwords; but it could also have multiple kinds of passwords. It could use passkeys for login. The login and signup forms are generated from data provided by extensions in a flexible manner; we don't have a similar mechanism for credentials change, but we probably should.

Is this something we can keep out of scope for this effort, and perhaps just link from Special:AccountSecurity to each of these pages?

Rename Special:OATHAuth to Special:AccountSecurity

Probably better (especially as a short-term solution) to keep Special:OATHAuth as is but don't link to it from preferences and have Special:AccountSecurity act as a sort of interstitial?

I would prefer to embed the 2FA stuff directly on Special:AccountSecurity, that's what the design calls for. I suppose we could keep Special:OATHAuth around and have it just redirect to Special:AccountSecurity.

In T401771#11100099, @Catrope wrote:

I would prefer to embed the 2FA stuff directly on Special:AccountSecurity, that's what the design calls for. I suppose we could keep Special:OATHAuth around and have it just redirect to Special:AccountSecurity.

I believe that's the plan in the current patch: https://gerrit.wikimedia.org/r/1180185

In T401771#11100099, @Catrope wrote:

In T401771#11099967, @Tgr wrote:

It's a bit more work but what do you think about adding a Special:AccountSecurity page to core, with some mechanism for extensions to add form blocks to it?

I like that idea, that would then avoid the need to mess with the preferences page from the extension.

Agree

In the short term, we decided to move ahead with this task as written, and implement Special:AccountSecurity in the OATHAuth extension. I do agree that @Tgr's idea is the better way to do this longer term, so I have filed it as T402427, which we plan to tackle later.

Change #1180185 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Rename Special:OATHAuth to Special:AccountSecurity for en and zh

https://gerrit.wikimedia.org/r/1180185

Change #1181112 had a related patch set uploaded (by Jly; author: Jly):

[mediawiki/extensions/OATHAuth@master] Update Preferences section for authentication

https://gerrit.wikimedia.org/r/1181112

Test wiki on Patch demo by JLy-WMF using patch(es) linked to this task was deleted:

https://6de3f379ca.catalyst.wmcloud.org/w/

Change #1190658 had a related patch set uploaded (by Reedy; author: Jly):

[mediawiki/extensions/OATHAuth@REL1_43] Rename Special:OATHAuth to Special:AccountSecurity for en and zh

https://gerrit.wikimedia.org/r/1190658

Change #1190660 had a related patch set uploaded (by Reedy; author: Jly):

[mediawiki/extensions/OATHAuth@REL1_44] Rename Special:OATHAuth to Special:AccountSecurity for en and zh

https://gerrit.wikimedia.org/r/1190660

Change #1190660 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@REL1_44] Rename Special:OATHAuth to Special:AccountSecurity for en and zh

https://gerrit.wikimedia.org/r/1190660

Change #1190658 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@REL1_43] Rename Special:OATHAuth to Special:AccountSecurity for en and zh

https://gerrit.wikimedia.org/r/1190658

Change #1181112 abandoned by SBassett:

[mediawiki/extensions/OATHAuth@master] Update Preferences section for authentication

Reason:

No longer relevant

https://gerrit.wikimedia.org/r/1181112