Help talk:Login notifications

About this board

I am undergoing training with a different laptop but forgot my password

1
197.211.52.36 (talkcontribs)

Please help me to recover my password

Reply to "I am undergoing training with a different laptop but forgot my password"

Yes, I have a secure password, but how can I tell it wasn't breached later?

1
Shanen (talkcontribs)

Not a useful warning. Wikipedia should include or allow me to access enough information to assess what sort of attack it was. Let me offer three attack scenarios that I could distinguish between. (1) Trivial dictionary attack with nothing but my user name and some frequently used passwords. This would be especially harmless if it was part of a broad attack at many user names. (2) A targeted attack based on one of my actual passwords. This might be a highly personal phishing attack where some other system has been breached and that password is being tested against other systems I might be using. (3) The attack might be based on a breach of Wikipedia itself, where the password they are probing with is a partial match of my actual password. Obviously not a total breach, since that would have avoided any login failure, but perhaps something that allows them to guess highly likely passwords and the failures were incorrect confirmation attempts.

In addition to information about the nature of the login failures, something to help identify a successful breech would be helpful. Right now the only information that comes to mind would be a summary of my edits since the possible attack. I probably can't remember every edit I've made, but I almost surely could recognize weird patterns.

(Why did it MediaWiki apparently log me out? Was that a security thing? Anyway, I don't see any reason not to put my identity on this suggestive feedback (?).)

Reply to "Yes, I have a secure password, but how can I tell it wasn't breached later?"

The notifications should be more informative...

5
71.178.21.164 (talkcontribs)

...for example, the e-mail should say the IP address, the owner of the IP (based on a "whois" lookup) and the operating system that the user was on, and whether the login was successful or not. (The way that the message is worded, it sounds like the logins were successful, therefore, probably me! But this help article says that the feature is triggered for unsuccessful logins. Multiple unsuccessful logins should result in a message saying how many unsuccessful attempts there were.)

~~~~

42.3.134.250 (talkcontribs)

I think so.

SharabSalam (talkcontribs)
98.110.130.20 (talkcontribs)

I agree.

  • The IP address / location would be helpful. I'd like to verify the login attempts are not the result of something going wrong with one of my devices.
  • I'd like to understand whether the IP trying to login eventually got blocked. Or are they allowed to continue trying to brute force their way in to my account?
Hv (talkcontribs)

I agree that the number of attempts would be particularly useful, to distinguish between a serious attempt to crack and someone not sure if this was their account name.

Reply to "The notifications should be more informative..."
Drmies (talkcontribs)

Didn't we use to get an email that indicated the IP address from which login attempts were made? That was a very useful thing that helped weed out LTAs. A page teaching me about passwords is of no use.

Reply to "IP identification?"

como faço para resolver isso

1
187.123.38.181 (talkcontribs)

Alguem pode me informar porque minha conta foi cancelada

Reply to "como faço para resolver isso"

Minha conta foi cancelada e não sei porque

1
187.123.38.181 (talkcontribs)

Foram detectados problemas com a sua sessão; Esta ação foi cancelada como medida de proteção contra a interceptação de sessões. Experimente usar o botão "Voltar" e atualizar a página de onde veio e tente novamente.

Reply to "Minha conta foi cancelada e não sei porque"
Valereee (talkcontribs)

This says: The extension allows you to get an email when a user logs in successfully to your account from an unfamiliar device and IP.

What extension? It says it's on by default but doesn't tell me where to check. Like, are we talking Preferences>somewhere? On my home wiki, or somewhere global? It would be useful to explain this for those who like me are not as techincally oriented, thanks!

Bubbabray33 (talkcontribs)

I agree, take me off as well

Reply to "Clarification needed"

Timing and extra information

1
Amire80 (talkcontribs)

I suspect that these notifications are shown a long time after the login attempt. Usually it's several hours, and sometimes it can be even several days. This misses the point of the notification. To be useful it's supposed to arrive after several seconds and not several hours. Sometimes I type my password incorrectly by mistake, and receive a notification after a long time. If I happen to remember that I mistyped the password, it's kind of OK, but it's not so robust. And when I don't remember if I mistyped it, I have to wonder: did I mistype it several days ago and forgot it, or was there an actual attempt to crack my account?

Other applications send such notifications instantly. Google and PayPal are obvious examples. They also show information the attempt, such as country and device brand. So it was an Android phone (which I own) from Israel (where I live), then it's less likely (though still possible) that it's a cracking attempt, and if it's a Windows device in Vietnam (this actually happened), then it may be a cracking attempt. I'm really, really not a security expert, but from the little I do know, these MediaWiki notifications are too slow and contain too little information to be really useful for security.

Reply to "Timing and extra information"

Why do these messages sometimes show the IP and sometimes not?

4
Deb (talkcontribs)

Apparently there have been 42 attempts to log into my account from other devices in the past 24 hours. Why is it that, when someone asks for a password change, we are told the IP address they tried it from, but when they make an attempt from another device, we can't get this information?

186.145.113.176 (talkcontribs)

Porque una la inicio desde el celular y la otra desde el lap top

Deb (talkcontribs)

I don't see how that's an answer. Every device has an IP address. ~~~~

Ciencia Al Poder (talkcontribs)

This has been requested at task T174388. Feel free to subscribe to that task to get updates

Reply to "Why do these messages sometimes show the IP and sometimes not?"

==Login succesful and phishing==

2
Summary by NKohli (WMF)

Unrelated to the extension.

2800:A4:2241:8400:501F:E115:8115:1B00 (talkcontribs)

What should we do if we can't login anymore because phishing has been succesful? Thanks

NKohli (WMF) (talkcontribs)