In T401771#11099967, @Tgr wrote:

In T401771#11087181, @JJMC89 wrote:

It's a bit more work but what do you think about adding a Special:AccountSecurity page to core, with some mechanism for extensions to add form blocks to it?

There are two obscure and very minimalistic special pages already, Special:ChangeCredentials and Special:RemoveCredentials, it would be nice to replace them with something that doesn't look like it's from the early 2000s edition of PhpBB.

The tricky part is that the set of credentials that can be added / changed / removed is managed via extensions. There's not guarantee the wiki has passwords; but it could also have multiple kinds of passwords. It could use passkeys for login. The login and signup forms are generated from data provided by extensions in a flexible manner; we don't have a similar mechanism for credentials change, but we probably should.

T401771 will create a Special:AccountSecurity page and link to it from Special:Preferences, but this code will live in the OATHAuth extension. We should move a basic version of this special page into MW core, and have OATHAuth add its blocks to it.