I have seen there is a lot of wikis where people are concerned about inactive sysops. They managed to set up a strange rule where sysop rights are removed from inactive users to improve the security. However the sysops are allowed to request the flag to be restored anytime. This doesn't improve security even a bit as long as hacker who would get to some of inactive accounts could just post a request and get the sysop rights just as if they hacked to active user. For this reason I think we should create a new extension auto sysop removal, which would remove the flag from all users who didn't login to system for some time, and if they logged back, the confirmation code would be sent to email, so that they could reactivate the sysop account. This would be much simpler and it would actually make hacking to sysop accounts much harder. I also believe it would be nice if system sent an email to holder of account when someone do more than 5 bad login attemps, in order to be warned that someone is likely trying to compromise their account.

I have seen there is a lot of wikis where people are concerned about inactive sysops. They managed to set up a strange rule where sysop rights are removed from inactive users to improve the security. However the sysops are allowed to request the flag to be restored anytime. This doesn't improve security even a bit as long as hacker who would get to some of inactive accounts could just post a request and get the sysop rights just as if they hacked to active user.

What happens if the ex-sysop has lost access to their original email address .. ?

2012/4/4 Petr Bena <benapetr(a)gmail.com>om>: There's no point in making technical solutions for problems which are imaginary in the first place, just as you say. The English Wikipedia community rejects the notion that sysop inactivity is a problem quite firmly, and it does just fine. Meta, Commons, my home Hebrew Wikipedia and some other projects do have such rules, and they are completely pointless. An account with sysop rights cannot do that much damage anyway. Deleting a page does no more damage than deleting a paragraph in an existent page, and the latter can be done by anybody; in fact, deleting a page makes a lot more noise. The same goes for protection, blocking and editing in the MediaWiki space - everything is easily traceable and reversible, and in a functioning wiki community the damage will be minimal.

On Wed, Apr 4, 2012 at 5:43 PM, Petr Bena <benapetr(a)gmail.com> wrote: Not all wikis blindly give the user their rights back when they do this "theatrical" based security model. There is already one that does this from memory (Without checking, E:LandLord) Again, Just theatrical security, Most people tend to use the same passwords everywhere, if this was the case for said Sysop, Their email is also compromised. Also this would require wikis to have email sending setup, as well as the user to have confirmed theirs.

Not really, per my point above.

On Wed, Apr 4, 2012 at 5:54 PM, Petr Bena <benapetr(a)gmail.com> wrote: Pointless user prefernce IMHO, we should just send them (for wikis that have email setup) and probably inculde a note along the lines of "You should consider making sure your password is secure, some handy hints are…"

The problem here is that it doesn't really discuss how a sysop account has been compromised; via the email account? Via some more direct method? As pointed out it is somewhat security theatre. Besides; you're looking for a problem to fit the solution. On English Wikipedia compromised accounts are, in themselves, rare occurrences. And compromised sysop accounts rarer (read; I've never seen one!). We discussed this at length when implementing the age-desysoping, and agreed it wasn't an entirely failsafe method against compromise. But it does provide a level of scrutiny to a  returning sysop; and really that is all that is needed. The amount of damage a compromised sysop account could do isn't critical and they can be stopped relatively easily - if they have scrutiny. This is the best form of security. Tom _______________________________________________ Wikitech-l mailing list Wikitech-l(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l

Also, you might want to query the databases to see how many admins don't have an email address set. I wouldn't be surprised if there are a few. IMO any that dont have an email set should have their sysop bit removed.

Actually sysops could be just required to have the email set in the project guidelines. If they don't do that and their account expire, they lost the sysop. I don't see it as a big deal. I hope that sysops are clever enough to at least be able to follow their own rules.

I don't say this would be enabled for all projects, it could be a replacement of that weird policy for removal of inactive sysops they created on few wikis, including english wikipedia. It would be just a slightly better solution for same problem as they have right now. If they don't want to update any policies they don't need to have it installed, of course.

Indeed :-) But if I didn't think it's weird, I wouldn't start this. I am always trying to find a solution from programmer point of view for a problems which community sometimes try to solve "by hand". From a security perspective (my speciality) there really isn't a lot of a

On 4 April 2012 10:28, Petr Bena <benapetr(a)gmail.com> wrote: From a security perspective (my speciality) there really isn't a lot of a difference between the two proposals in terms of the problems they face. Except that the current process requires a certain "human" involvement, and scrutiny. Which is usually the best security mechanism. A determined attacker is going to be able to break through either process; but in the current setup their subsequent actions are likely to be noticed. Tom _______________________________________________ Wikitech-l mailing list Wikitech-l(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l

annoying, but also not fail safe, some accounts might be overlooked, Certainly automatic de-sysoping after a certain inactivity would be useful; an extension that does the notifications and ultimately the de-sysoping would be useful to automate the community approved process, don't get me wrong on that front, I like the idea! Not a good premise to take; email accounts are high value targets (as opposed to a Wikipedia account, which has relatively low general value). So although they are harder to crack (to a point) they are also more worthwhile targets. So an email account is a significant risk. And an account without an email address added could be argued to be *more*secure. the google for example offers a It's largely security theatre; except the two factor authentication (which is actually useful). Our accounts simple aren't that valuable, which is why actual security of that form isn't really a good option. What you proposed is only really a stopgap. Realistically, and in my experience, this is not the case. You're relying on the user to respond, or being in a position to respond - which is the critical failing of the proposal. When we do pen tests often we will make notifications of some sort appear in front of users to see how they respond to them - and often the response is confusion, not concern. Remember; the large part of the WM community is * not* technical. Tom _______________________________________________ Wikitech-l mailing list Wikitech-l(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l

Besides; you're looking for a problem to fit the solution. On English Wikipedia compromised accounts are, in themselves, rare occurrences. And compromised sysop accounts rarer (read; I've never seen one!).

Ok, your reply makes a lot of sense. However problem is that how users get more "hats" they are usually more afraid of loosing them :-) and would probably like to have an option to protect from attackers (I don't really know but I hope that people with some extra flags are trying to have a secure password at least). The account is getting more valuable and for example account of some stewards might be a good target for hackers. The question is how these people can defend themselves when the philosophy is "we don't need strong security because user accounts aren't valuable / can't do much damange to site" - when their account is compromised, they will surely have the flags revoked permanently, that's likely not what they want. So at some point, having more security measures which could be opt-in for people who do care about their account, in opposite of people whom account isn't interesting for hackers would make some point too. Given that there are thousands of sysops on big projects, I guess they would welcome to have this feature. (Not that I care, personally, I was just interested in implementing that to mediawiki) On Wed, Apr 4, 2012 at 11:48 AM, Thomas Morton <morton.thomas(a)googlemail.com> wrote: >> >> The current process needs to be done by hand, which isn't just > > annoying, but also not fail safe, some accounts might be overlooked, >> etc. Bureaucrats can mislick or forget. > > > Certainly automatic de-sysoping after a certain inactivity would be > useful; > an extension that does the notifications and ultimately the de-sysoping > would be useful to automate the community approved process, don't get me > wrong on that front, I like the idea! > > >> The email account is likely >> much more safe than wikimedia account, > > > Not a good premise to take; email accounts are high value targets (as > opposed to a Wikipedia account, which has relatively low general value). > So although they are harder to crack (to a point) they are also more > worthwhile targets. > > So an email account is a significant risk. > > And an account without an email address added could be argued to be > *more*secure. > > the google for example offers a >> lot of security measures we don't, because they don't follow "hacking >> user wouldn't do much damage" philosophy. > > > It's largely security theatre; except the two factor authentication > (which > is actually useful). Our accounts simple aren't that valuable, which is > why > actual security of that form isn't really a good option. What you > proposed > is only really a stopgap. > > >> And I guess many other >> providers do the same. Hacking to two accounts would be much harder >> than hacking one, given to that once the first account is hacked, the >> user would be immediately notified in email (hacker would have very >> limited time to hack to email box as well). >> > > Realistically, and in my experience, this is not the case. You're > relying > on the user to respond, or being in a position to respond - which is the > critical failing of the proposal. > > When we do pen tests often we will make notifications of some sort > appear > in front of users to see how they respond to them - and often the > response > is confusion, not concern. Remember; the large part of the WM community > is * > not* technical. > > Tom

I said it would be opt-in so they wouldn't be spammed unless they would like to be

On Wed, Apr 4, 2012 at 8:33 AM, Petr Bena <benapetr(a)gmail.com> wrote: I would like to remind everyone that user preferences are evil--especially when it comes to things relating to security. The correct thing to do is to come up with sensible defaults that work for everyone. -Chad _______________________________________________ Wikitech-l mailing list Wikitech-l(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l

On Wed, Apr 4, 2012 at 7:38 AM, Petr Bena <benapetr(a)gmail.com> wrote: Bluntly? Users, for the most part, are stupid. Or rather, they make silly choices that can make systems more vulnerable without knowing better. _______________________________________________ Wikitech-l mailing list Wikitech-l(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l

Also keep in mind we are talking about accounts which are interesting for hackers, stewards and such. I hope that people who are volunteering as stewards aren't just "stupid" and would eventually read manual / ask someone who knows how does it work, before changing options in insecure way. (Anyway if it was opt-in it would be either more secure or same insecure as it's now) On Wed, Apr 4, 2012 at 4:35 PM, Petr Bena <benapetr(a)gmail.com> wrote: > That sounds like as microsoft would interpret how perfect system > should work, and why I don't like windows: > > "We know best what the user wants, so let us configure the system > according to what we think that is best for them, without even giving > them option to change anything on that" > > Seriously, don't make microsoft windows from mediawiki, please. We > could as well make mediawiki do what it "thinks that user wants to do" > rather than "what user really wants" > > On Wed, Apr 4, 2012 at 4:24 PM, OQ <overlordq(a)gmail.com> wrote: >> On Wed, Apr 4, 2012 at 7:38 AM, Petr Bena <benapetr(a)gmail.com> wrote: >>> Why is it evil? >> >> Bluntly? >> Users, for the most part, are stupid. Or rather, they make silly >> choices that can make systems more vulnerable without knowing better. >> >> _______________________________________________ >> Wikitech-l mailing list >> Wikitech-l(a)lists.wikimedia.org >> https://lists.wikimedia.org/mailman/listinfo/wikitech-l

Also keep in mind we are talking about accounts which are interesting for hackers, stewards and such. I hope that people who are volunteering as stewards aren't just "stupid" and would eventually read manual / ask someone who knows how does it work, before changing options in insecure way. (Anyway if it was opt-in it would be either more secure or same insecure as it's now)

On Wed, Apr 4, 2012 at 7:38 AM, Petr Bena <benapetr(a)gmail.com> wrote: Bluntly? Users, for the most part, are stupid. Or rather, they make silly choices that can make systems more vulnerable without knowing better.

That's something 1 group of people agree and another strongly disagree Let's make both, if you really want simple preferences, why not to have "advanced" toggle, which uncover the complex stuff?

That isn't excuse to leave project open to damage. Security of mediawiki users and their accounts should be important for us anyway.

Let me clarify: we are talking about accounts which are interesting for hackers such as these of stewards.

That was just an example, interesting are of course even checkuser accounts and such. I don't see any reason why system which notify you that someone is trying to login as you is something bad for stewards.

On Wed, Apr 4, 2012 at 6:25 PM, Petr Bena <benapetr(a)gmail.com> wrote: Actually, this is the most important thing to think about. There is no such thing as perfect security. You just need to make it more costly to breach security than the benefit that a hacker would get for it. Conversely, you need to expend no more effort in security than the cost of a breach in security. Now, there are things that sysops can do that aren't so easily reversible. You could surreptitiously add site JS that captured tokens from checkusers and released large amounts of sensitive data, so it's not exactly without merit. But I don't think it's justifiable to dismiss discussion about whether extra security is "worth it".

"If I wanted to cause harm to an editing community, one of the better ways might be ..." sounds dangerous from someone who has access to servers :-)