Over time, the terms we use for authenticator types/methods and our related systems have evolved. To improve the clarity and consistency of documentation, we should define which terms to use for a given concept, and update docs to use those preferred terms consistently.
So far, I've identified the following terms in need of standardization: https://meta.wikimedia.org/wiki/User:TBurmeister_(WMF)/Sandbox/Account_security_glossary
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T399644 FY2025-26 WE4.6.2 Multiple Authenticators | |||
| Resolved | TBurmeister | T399657 Update existing 2FA documentation | |||
| Resolved | TBurmeister | T409768 Standardize 2FA terminology usage across docs and UI |
We send out one-time verification codes via email via the EmailAuth extension when the user does not have 2FA setup (and some other conditions about the login attempt are fulfilled) so calling the TOTP codes verification codes might be confusing. Maybe "authenticator app verification codes" vs. "email verification codes"? A bit long though.
Security keys are a subclass of passkeys. (If you want to be very technical about it, passkeys are credentials used for WebAuthn login, which might come from security keys or other sources, and most security keys can be used in other ways than WebAuthn. But probably better to be simple than super accurate.)
Passkeys can be used a single factor for login; Wikimedia sites currently don't support this, but AIUI it's in the plans. So we might want to consider avoiding the term "2FA" as much as we can.
U2F is probably unhelpful outside of technical documentation, and not that relevant in technical documentation - it's an outdated standard that, for most purposes, has been replaced by WebAuthn and CTAP (and CTAP is about the communication between the browser and the authenticator device which we don't interfere with, so mostly we just need to talk about WebAuthn). Security keys are sometimes called U2F compatible or such, but I think these days this is uncommon and technical docs just refer to WebAuthn (or maybe FIDO2 which is the official name of WebAuthn + CTAP taken together, but also not used much).
Thank you @Tgr! For posterity and easier tracking, I'm also adding here feedback from others that I received via WMF Slack:
From @EMill-WMF:
From @Reedy:
Change #1206427 had a related patch set uploaded (by Triciaburmeister; author: Triciaburmeister):
[mediawiki/extensions/OATHAuth@master] UI: Standardize terminology and improve copy
Change #1206427 merged by jenkins-bot:
[mediawiki/extensions/OATHAuth@master] UI: Standardize terminology and improve copy
Change #1207924 had a related patch set uploaded (by Reedy; author: Triciaburmeister):
[mediawiki/extensions/OATHAuth@REL1_45] UI: Standardize terminology and improve copy
Change #1207924 merged by jenkins-bot:
[mediawiki/extensions/OATHAuth@REL1_45] UI: Standardize terminology and improve copy
I have updated or checked the 2FA terminology on various pages (listed below) and will use the preferred terms in my ongoing rewrite of Help:Two-factor_authentication.
List of pages checked and (wherever possible) updated for terminology consistency:
I did not update the following pages because that will require some engagement with the en wiki community, which will be coordinated after Help:Two-factor_authentication is fully updated and this quarter's development work is complete:
Change #1214157 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/extensions/WikimediaMessages@master] wikimediaoverrides: Update OATHAuth copy
Change #1214157 merged by jenkins-bot:
[mediawiki/extensions/WikimediaMessages@master] wikimediaoverrides: Update OATHAuth copy
Change #1214544 had a related patch set uploaded (by Triciaburmeister; author: Triciaburmeister):
[mediawiki/extensions/WikimediaMessages@master] wikimediaoverrides: Update WebAuthn and OATHAuth copy
Change #1214544 abandoned by Triciaburmeister:
[mediawiki/extensions/WikimediaMessages@master] wikimediaoverrides: Update WebAuthn and OATHAuth copy
Reason:
Making these changes in the WebAuthn extension instead
Change #1214643 had a related patch set uploaded (by Triciaburmeister; author: Triciaburmeister):
[mediawiki/extensions/WebAuthn@master] UI: Update copy to use preferred terms
Change #1214643 merged by jenkins-bot:
[mediawiki/extensions/WebAuthn@master] UI: Update copy to use preferred terms