Page MenuHomePhabricator
Create Task
Maniphest T415093

Passkey section on Special:AccountSecurity moves around unexpectedly
Open, Needs TriagePublic
Actions

Description

When testing the new passkey functionality on http://en.wikipedia.beta.wmflabs.org/wiki/Special:AccountSecurity:

Before I enable 2FA, the section to add a passkey appears below the 2FA section:

passkey section before 2fa.png (2,016×1,777 px, 150 KB)

After I enable 2FA, the passkey section moves up and appears in a different place on the page:

passkey section after 2fa.png (2,016×1,777 px, 172 KB)

I suspect this is an intentional design choice, because users can't enable passkeys until after they have added a 2FA method. However, this behavior and UI inconsistency is unexpected to me as a user; I would expect to find these page elements in the same place on the page. When I went back to Special:AccountSecurity after adding a 2FA method, I was surprised that the Passkey section was in a dfiferent place.

Suggestion: put the passkey section between the password and 2FA sections permanently. The UI text explaining that you must enable 2FA before you can add a passkey is sufficiently clear.

Details

Related Changes in Gerrit:
SubjectRepoBranchLines +/-
WIP: OATHManage: Don't move passkeys section aroundmediawiki/extensions/OATHAuthmaster+1 -4
Customize query in gerrit

Related Objects

Event Timeline

TBurmeister created this task.Jan 20 2026, 4:43 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJan 20 2026, 4:43 PM
Reedy moved this task from Backlog to User Experience on the MediaWiki-extensions-OATHAuth board.Jan 21 2026, 12:08 AM
Catrope moved this task from WE 4.6.4 - 2FA improvements and passkey support to WE 4.6.9 (Passwordless login and passkey promotion) on the FY2025-26 WE 4.6 - Account Security board.Feb 19 2026, 7:00 PM
Catrope edited projects, added: FY2025-26 WE 4.6 - Account Security (WE 4.6.9 (Passwordless login and passkey promotion)); removed: FY2025-26 WE 4.6 - Account Security (WE 4.6.4 - 2FA improvements and passkey support).
Reedy subscribed.May 6 2026, 4:22 PM

rEOATa2b71beb8a15: Vue version of Special:OATHManage did this explicitly:

		$output->addHTML( Html::rawElement( 'div', [ 'class' => 'mw-special-OATHManage-vue-container' ],
			// If 2FA is enabled, then put passkeys first, otherwise put 2FA first
			$keyAccordions === '' ?
				$authMethodsSection . $passkeySection :
				$passkeySection . $authMethodsSection
		) );
Restricted Application added a project: Product Safety and Integrity. · View Herald TranscriptMay 6 2026, 4:22 PM
gerritbot added a comment.May 6 2026, 4:31 PM

Change #1283829 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OATHAuth@master] WIP: OATHManage: Don't move passkeys section around

https://gerrit.wikimedia.org/r/1283829

gerritbot added a project: Patch-For-Review.May 6 2026, 4:31 PM
Reedy added a comment.May 6 2026, 4:51 PM

The other is that OATHManage.vue also moves the passkey section around... The WIP change above results in a visible re-order, which is somewhat funny to watch.

I think the passkey section will be listed first if you have them enabled too.

So that's at least 3 different places it can end up?

We do have the To add a passkey you must first set up two-factor authentication. message, so even if it's not useable in all cases, it should be clear why.

If we decide the purposeful order, we need to further change the OATHManage file, and then update OATHManage.vue to match!

Reedy updated the task description. (Show Details)Fri, May 22, 8:27 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits