Page MenuHomePhabricator

Apply temporary account creation limits to /64 range for IPv6
Closed, ResolvedPublic

Description

Motivation

Switching between IPs within the same IPv6 range happens frequently. We want to minimize the ability for vandals to abuse temporary accounts by expanding the rate limits to the entire range.

Acceptance criteria
  • The account creation rate limit for temp accounts (currently 6/day) should apply to the entire IPv6 /64 range
  • No change for IPv4 IPs

Event Timeline

Niharika triaged this task as Medium priority.

I think this should be fine for temporary users. The only contexts I can think of where multiple people might share the same /64, are corporate/institutional networks, a limited number of mobile carrier networks, shared public networks like libraries and cafes, and certain proxy or tunneling services. We might want to implement some kind of banner to inform users about this possibility, but these are basically cases where (I believe) anonymous editing shouldn't really happen, since users can blend together indiscriminately, much like with open proxies.

Change #1194948 had a related patch set uploaded (by STran; author: STran):

[mediawiki/core@master] Apply temporary account creation limit to /64 range for IPv6 IPs

https://gerrit.wikimedia.org/r/1194948

I think this should be fine for temporary users. The only contexts I can think of where multiple people might share the same /64, are corporate/institutional networks, a limited number of mobile carrier networks, shared public networks like libraries and cafes, and certain proxy or tunneling services. We might want to implement some kind of banner to inform users about this possibility, but these are basically cases where (I believe) anonymous editing shouldn't really happen, since users can blend together indiscriminately, much like with open proxies.

Thanks, @Dragoniez. To address the concern about informing users, I'd say that we focus our efforts on T357802: Design & Copy: Prompt user to create a regular account after temp account creation rate limit trip.

Change #1194948 merged by jenkins-bot:

[mediawiki/core@master] Apply temporary account creation limit to /64 range for IPv6 IPs

https://gerrit.wikimedia.org/r/1194948

Change #1195400 had a related patch set uploaded (by Kosta Harlan; author: STran):

[mediawiki/core@wmf/1.45.0-wmf.22] Apply temporary account creation limit to /64 range for IPv6 IPs

https://gerrit.wikimedia.org/r/1195400

Change #1195400 merged by jenkins-bot:

[mediawiki/core@wmf/1.45.0-wmf.22] Apply temporary account creation limit to /64 range for IPv6 IPs

https://gerrit.wikimedia.org/r/1195400

Djackson-ctr subscribed.

New Code Changes have been implemented (Per the Acceptance Criteria), and verified.