Feature summary (what you would like to be able to do and where):
The skipcaptcha user right is used to allow users to avoid some CAPTCHAs on Wikipedia. For example, it allows users to add external links to pages without being subjected to a CAPTCHA. Unfortunately, abuse filters currently always respect the skipcaptcha right, completely preventing abuse filters from applying a CAPTCHA action to edits and page moves. On English Wikipedia, this means there's no way for an abuse filter to CAPTCHA any edit or move from any autoconfirmed user.
It would be helpful if abuse filters could apply CAPTCHA actions even to users with the skipcaptcha right (either by removing the restriction entirely or by making it configurable per-filter).
Use case(s) (list the steps that you performed to discover that problem, and describe the actual underlying problem which you want to solve. Do not describe only a solution):
Certain types of attacks that happen after an account has obtained the skipcaptcha right, especially vandalism and spam. Some specific example use cases:
- Many LTAs use accounts aged for several days, make several innocuous edits to game the autoconfirmed group, and then vandalize semi-protected articles.
- Some LTAs use accounts aged for 30+ days, rack up a very high number of automated edits in a short period of time to game the extendedconfirmed group, and then vandalize extended confirmed protected articles.
- Some spammers will age accounts to autoconfirmed status specifically to bypass CAPTCHA on external links.
- Some abusers script very fast edits after reaching autoconfirmed or extended confirmed. Abuse filters can detect high edit velocity. Since high edit velocity is not always abusive, being able to apply a CAPTCHA is a good way to slow down probable abuse without completely preventing legitimate users from making a change.
Benefits (why should this be implemented?):
We need to be able to allow abuse filters to slow down certain types of attacks that happen after an account has obtained the skipcaptcha right. We could slow down these attacks with a CAPTCHA action on an abuse filter.
Abuse filters have the benefit of being able to enforce CAPTCHA only in narrowly-defined cases (e.g., only when posting certain link patterns, or creating many pages quickly), reducing the amount of damage from certain types of bad actors that are frequently reaching autoconfirmed with their accounts while also affecting as few legitimate users as possible.