Create a special page to generate additional recovery keys for other users
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	mszwarc
	Jan 29 2026, 11:39 AM

Project Tags

Referenced Files

None

Subscribers

Description

Background

Currently, if a user loses access to all of their 2FA methods, they reach out to Trust & Safety, who (after verifying the request) disables 2FA on the user's account. Given that we want to go towards a situation, where certain groups of users cannot have their 2FA disabled, this process doesn't fit well into the general concept of 2FA requirement.

Feature description

We'd like to build a new special page, Special:RecoverOATHForUser, where T&S officers can generate a new set of recovery keys for a given user. The initial form on the new special page will be similar to the one at Special:DisableOATHForUser. Eventually, the old page will be deleted.

Acceptance criteria

Upon submitting Special:RecoverOATHForUser, $wgOATHRecoveryCodesCount (10) new recovery codes are generated for the target user.
Recovery codes are sent to the user by e-mail. If the target user has no e-mail set, the T&S officer is prompted to enter an e-mail address to send the codes to.
The target user receives a notification via Echo that new recovery codes have been generated for their account. The notification asks user to immediately contact T&S if this action wasn't initiated by themselves.
The original recovery codes are kept and can be used by the target account to log in.

Details

Related Changes in Gerrit:

Subject	Author	Repo	Branch	Lines +/-
Recover2FAForUser: Use e-mail from CentralAuth if user is not local	Mszwarc	mediawiki/extensions/OATHAuth	master	+68 -0
Add '(oathauth-recover-for-user)' to 'wmf-supportsafety'	Mszwarc	operations/mediawiki-config	master	+1 -0
Recover2FAForUser: Check if user's email is confirmed	Mszwarc	mediawiki/extensions/OATHAuth	master	+23 -7
Recover2FAForUser: Send additional recovery codes by email	Mszwarc	mediawiki/extensions/OATHAuth	master	+243 -37
Add ignored messages from Extension:OATHAuth	Mszwarc	translatewiki	master	+3 -0
Recover2FAForUser: Send Echo notifications on recovery	Mszwarc	mediawiki/extensions/OATHAuth	master	+122 -0
Create Special:Recover2FAForUser	Mszwarc	mediawiki/extensions/OATHAuth	master	+507 -43
Support generating additional codes in RecoveryCodeKeys	Mszwarc	mediawiki/extensions/OATHAuth	master	+48 -3

Customize query in gerrit

Related Objects
Search...

Status	Assigned	Task
		Restricted Task
Open	None	T150898 Force OATHAuth (2FA) for certain user groups in Wikimedia production and Beta wikis
Resolved	mszwarc	T414907 Enforce 2FA-requiring groups using $wgRestrictedGroups
		Restricted Task
		Restricted Task
Resolved	mszwarc	T415883 Create a special page to generate additional recovery keys for other users
Resolved	mszwarc	T416484 Override notifications related to 2FA recovery, so that they refer to Wikimedia concepts
Resolved	mszwarc	T420200 Special:Recover2FAForUser should generate short-lived recovery codes
Resolved	mszwarc	T420201 OATHAuth: Add support for expiring recovery codes

Event Timeline

mszwarc created this task.Jan 29 2026, 11:39 AM

mszwarc moved this task from Backlog to Features/Improvements on the MediaWiki-extensions-OATHAuth board.

mszwarc moved this task from Backlog to In progress on the Product Safety and Integrity (Sprint Daffodil (Jan 19 - Feb 6)) board.Jan 29 2026, 11:42 AM

Reedy updated the task description. (Show Details)Jan 29 2026, 1:01 PM

Reedy updated the task description. (Show Details)Jan 29 2026, 1:03 PM

Change #1235015 had a related patch set uploaded (by Mszwarc; author: Mszwarc):

[mediawiki/extensions/OATHAuth@master] Support generating additional codes in RecoveryCodeKeys

https://gerrit.wikimedia.org/r/1235015

gerritbot added a project: Patch-For-Review.Jan 29 2026, 1:32 PM

Johannnes89 subscribed.Jan 29 2026, 1:38 PM

Change #1235015 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Support generating additional codes in RecoveryCodeKeys

https://gerrit.wikimedia.org/r/1235015

ReleaseTaggerBot added a project: MW-1.46-notes (1.46.0-wmf.14; 2026-02-03).Jan 30 2026, 1:00 AM

Maintenance_bot removed a project: Patch-For-Review.Jan 30 2026, 1:31 AM

mszwarc updated the task description. (Show Details)Feb 2 2026, 12:13 PM

Change #1235789 had a related patch set uploaded (by Mszwarc; author: Mszwarc):

[mediawiki/extensions/OATHAuth@master] Create Special:RecoverOATHForUser

https://gerrit.wikimedia.org/r/1235789

gerritbot added a project: Patch-For-Review.Feb 2 2026, 12:29 PM

Change #1236294 had a related patch set uploaded (by Mszwarc; author: Mszwarc):

[mediawiki/extensions/OATHAuth@master] RecoverOATHForUser: Send additional recovery codes by email

https://gerrit.wikimedia.org/r/1236294

Change #1236732 had a related patch set uploaded (by Mszwarc; author: Mszwarc):

[mediawiki/extensions/OATHAuth@master] RecoverOATHForUser: Send Echo notifications on recovery

https://gerrit.wikimedia.org/r/1236732

mszwarc created subtask T416484: Override notifications related to 2FA recovery, so that they refer to Wikimedia concepts.Feb 4 2026, 2:46 PM

mszwarc mentioned this in T416484: Override notifications related to 2FA recovery, so that they refer to Wikimedia concepts.

mszwarc moved this task from In progress to Needs review on the Product Safety and Integrity (Sprint Daffodil (Jan 19 - Feb 6)) board.Feb 5 2026, 8:55 AM

Change #1235789 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Create Special:Recover2FAForUser

https://gerrit.wikimedia.org/r/1235789

ReleaseTaggerBot edited projects, added: MW-1.46-notes (1.46.0-wmf.15; 2026-02-10); removed: MW-1.46-notes (1.46.0-wmf.14; 2026-02-03).Feb 5 2026, 9:00 PM

Change #1237456 had a related patch set uploaded (by Mszwarc; author: Mszwarc):

[translatewiki@master] Add ignored messages from Extension:OATHAuth

https://gerrit.wikimedia.org/r/1237456

mszwarc updated the task description. (Show Details)Feb 6 2026, 2:06 PM

Eventually, the old page will be deleted.

For users without advanced rights, 2FA would be optional and it would be simplier if older 2FA setup is simply removed and user can setup new 2FA again. This will also benefit sysops or stewards if they eventually get 2FA reset permission (T180896): user can simply contact sysops/stewards they personally know via off-wiki means and they can remove 2FA without involving emails. Using emails to send additional recovery codes has their own risks (see below).

Recovery codes are sent to the user by e-mail

Most email providers keeps email forever and e-mail can be used to reset password of connected account. So if the user requested 2FA recovery and later an attacker compromised their email (which can be years later) can simply use email and recovery code to break into their account. One way to mitigate it is to let these recovery code sent via email expire after some time (e.g. 7 days) and encourage user to generate new premanent recovery codes.

OKryva-WMF edited projects, added: Product Safety and Integrity (Sprint Flower (Feb 9 - Feb 27)); removed: Product Safety and Integrity (Sprint Daffodil (Jan 19 - Feb 6)).Feb 10 2026, 8:21 AM

OKryva-WMF moved this task from Backlog to Needs review on the Product Safety and Integrity (Sprint Flower (Feb 9 - Feb 27)) board.Feb 10 2026, 8:21 AM

Change #1239017 had a related patch set uploaded (by Mszwarc; author: Mszwarc):

[mediawiki/extensions/OATHAuth@master] Recover2FAForUser: Use e-mail from CentralAuth if user is not local

https://gerrit.wikimedia.org/r/1239017

Change #1236294 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Recover2FAForUser: Send additional recovery codes by email

https://gerrit.wikimedia.org/r/1236294

ReleaseTaggerBot edited projects, added: MW-1.46-notes (1.46.0-wmf.16; 2026-02-17); removed: MW-1.46-notes (1.46.0-wmf.15; 2026-02-10).Feb 15 2026, 9:00 AM

Change #1236732 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Recover2FAForUser: Send Echo notifications on recovery

https://gerrit.wikimedia.org/r/1236732

Change #1237456 merged by jenkins-bot:

[translatewiki@master] Add ignored messages from Extension:OATHAuth

https://gerrit.wikimedia.org/r/1237456

mszwarc closed subtask T416484: Override notifications related to 2FA recovery, so that they refer to Wikimedia concepts as Resolved.Feb 16 2026, 9:04 AM

mszwarc updated the task description. (Show Details)

In T415883#11594348, @Bugreporter wrote:

Eventually, the old page will be deleted.

For users without advanced rights, 2FA would be optional and it would be simplier if older 2FA setup is simply removed and user can setup new 2FA again. This will also benefit sysops or stewards if they eventually get 2FA reset permission (T180896): user can simply contact sysops/stewards they personally know via off-wiki means and they can remove 2FA without involving emails. Using emails to send additional recovery codes has their own risks (see below).

I see the point. For sure, as a result of the current work we will make sure that nobody can access the disable 2FA page on WMF cluster. We might want to revisit that if/when we start working on T180896. Either way, that page would need to be adapted to restrict for whom the performer is able to remove 2FA.

Recovery codes are sent to the user by e-mail

Most email providers keeps email forever and e-mail can be used to reset password of connected account. So if the user requested 2FA recovery and later an attacker compromised their email (which can be years later) can simply use email and recovery code to break into their account. One way to mitigate it is to let these recovery code sent via email expire after some time (e.g. 7 days) and encourage user to generate new premanent recovery codes.

Expiration time for recovery codes is an idea that appeared already in our internal conversations. It's not straightforward to implement, that's why the current implementation just generates additional permanent codes. However, we're open to come back to that a bit later. (Given that requests to recover access to 2FA-protected accounts are rare, not working on this immediately should not introduce significant vulnerabilities.)

Change #1239627 had a related patch set uploaded (by Mszwarc; author: Mszwarc):

[mediawiki/extensions/OATHAuth@master] Recover2FAForUser: Tweak language, check if user's email is confirmed

https://gerrit.wikimedia.org/r/1239627

Change #1239627 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Recover2FAForUser: Check if user's email is confirmed

https://gerrit.wikimedia.org/r/1239627

Change #1240270 had a related patch set uploaded (by Mszwarc; author: Mszwarc):

[operations/mediawiki-config@master] Add '(oathauth-recover-for-user)' to 'wmf-supportsafety'

https://gerrit.wikimedia.org/r/1240270

Change #1240270 merged by jenkins-bot:

[operations/mediawiki-config@master] Add '(oathauth-recover-for-user)' to 'wmf-supportsafety'

https://gerrit.wikimedia.org/r/1240270

Mentioned in SAL (#wikimedia-operations) [2026-02-18T14:07:39Z] <mszwarc@deploy2002> Started scap sync-world: Backport for [[gerrit:1240277|ruwikisource: EnableProtectionIndicators (T417590)]], [[gerrit:1240270|Add '(oathauth-recover-for-user)' to 'wmf-supportsafety' (T415883)]]

Stashbot mentioned this in T417590: Enable the Protection indicators for ru.wikisource.Feb 18 2026, 2:07 PM

Mentioned in SAL (#wikimedia-operations) [2026-02-18T14:09:52Z] <mszwarc@deploy2002> anzx, mszwarc: Backport for [[gerrit:1240277|ruwikisource: EnableProtectionIndicators (T417590)]], [[gerrit:1240270|Add '(oathauth-recover-for-user)' to 'wmf-supportsafety' (T415883)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2026-02-18T14:15:48Z] <mszwarc@deploy2002> Finished scap sync-world: Backport for [[gerrit:1240277|ruwikisource: EnableProtectionIndicators (T417590)]], [[gerrit:1240270|Add '(oathauth-recover-for-user)' to 'wmf-supportsafety' (T415883)]] (duration: 08m 10s)