Extension:PasswordlessLogin

The Passwordless Login extension is an experimental extension that was created during the Wikimedia Hackathon 2019 in Prague. It allows an user to login to their user account on a MediaWiki site without entering their password anymore. Instead they can confirm that they want to login with their previously paired smartphone.

The login mechanism can be considered secure as long as the MediaWiki site where the user wants to login is accessible by https only. There's which, if implemented, requires the user of https at all.

Configuration

 * PLFirebaseAccessToken: The access token you can retrieve from your Firebase project under the settings. This access token is used to be able to send messages to an Android device to verify the login.

Android app
This extension requires a second factor in order to work. There's an Android app, which implements the counterpart of this extension. The app is published on the Google Play Store. However, you can also build it yourself from the sources.

Privacy Policy for the Android App
The Android app, which is built from these sources, does not save any personal related information or communicates with any service except the MediaWiki sites you connect this app with. The app will communicate with the Firebase Cloud Messaging service in order to generate a unique ID, with which a single device can be identified. This ID is transmitted to the MediaWiki sites you register within the app and will be saved on the servers hosting this site. The ID is used to create a login prompt when you login on one of the registered MediaWiki sites.