Currently, we require 2FA from four local groups CentralNotice administrators, checkusers, interface administrators, suppressors.
They are enforced using $wgOATHRequiredForGroups, which can disable the group membership for 2FA-less users. While it inclined most users of these groups to enable 2FA, a significant number of accounts has been left without 2FA. These accounts still pose a potential attack surface that could affect our other users.
To mitigate this, we'll switch to modern 2FA enforcement using $wgRestrictedGroups for these groups and additionally the following ones: Wikidata Staff, Wikifunctions Staff, WMF Office IT, WMF Trust & Safety.
The deployment for every group will happen in two stages, separated by about 2 weeks:
- In the first stage, group members without 2FA will have their group membership disabled (as currently). Furthermore, it will be impossible to grant the group to a 2FA-less user. 2FA-enabled members of the group won't be able to completely disable 2FA on their account (they will still be able to add and remove 2FA methods, as long as there's at least one method continuously enabled). At this stage, the group will also be removed from $wgOATHRequiredForGroups.
- After 2 weeks, in the second stage, group members without 2FA will be removed from the group. Nothing will change for users with 2FA enabled.
Nothing will change for users who are not members of the listed groups. For them, 2FA will still be optional. This change will enforce policy that's already been in force for as long as 7 years for some groups (and at least 10 months for others).
Deployment timeline
Deployments will usually happen at the beginning of the week
- week of March 2nd: First stage for CentralNotice admins and WMF Trust & Safety
- week of March 9th: First stage for the other 6 groups
- week of March 16th: Second stage for CN admins and WMF T&S
- week of March 23rd: Second stage for the other 6 groups