Change Details

After T94774, we can define password policies based on group membership. Users in the Stewards group (https://meta.wikimedia.org/wiki/Special:GlobalGroupPermissions/steward) have access to interface editing globally, and are allowed to give themselves checkuser access. An account compromise could have a significant impact on the sites availability (adding slow/harmful javascript to the site), user privacy (checkuser, adding tracking code to the interface), and reputation (deliver browser exploits from our sites). My proposal is setting an 8-byte minimum length (users will be prompted to change their password on login) in the near term, and then require 8-byte minimum passwords to login after users have had time to update their passwords.