| • bzimport | |
| May 8 2007, 2:51 AM |
| F3713: patch | |
| Nov 21 2014, 9:36 PM |
Author: titoxd.wikimedia
Description:
Thinking along the lines of T11816, it would be advisable to send an email
notification to an account owner if someone is trying to log in to an account
and fails X number of times within a particular period of time.
URL: https://en.wikipedia.org/wiki/Special:Userlogin
See Also: T28227: Notify user by email when password changed
See https://www.mediawiki.org/wiki/Writing_an_extension_for_deployment ; typically a new extension takes between few weeks and a decade.
I have no specific timeline yet. Not for a while yet. Ill make sure tech news is notified whenever this becomes imminent
In a long comment (now more like a paper), I added new ideas in T18435: New extension to enforce minimum password strength.
I've included additional considerations on security but the main point is about evaluation of password strength and how we can help users choosing stronger passwords (not just based on simple password lengths that users can't remember): it gives more choices to users and could provide better hints for them than just a simple measurement.
Consider commenting on it. After an initial request (TL;DR for a simple comment) I added some headings and structured it a bit, fixing some typos and adding notes for further considerations in each part.
There are also some possible extension about "strength classes" that we could administer for securiing the strongest class that should be needed to access some very elevated privileges (direct SQL access, inspecting server log files and private user data stored on servers, maintenance of the technical platform including DNS administration, write access to the MediaWiki code...)
LoginNotify is now on Test Wikipedia -- https://test.wikipedia.org/wiki/Main_Page
It's available for testing, if people want to give it a try.
The project page is here, with more info on the feature: