Help talk:Login notifications

Use actual notification text with interface

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

Hi!

I think it would be useful for maintaining and for translations to use {{int}} magic word for notification texts.

I’ve looked for the corresponding system message, but I have not found actual ones and they seem to do not be available on mediawiki.org. Pols12 (talk) 16:01, 17 August 2017 (UTC)

I'm not sure what you mean. The message strings are on TranslateWiki: https://translatewiki.net/w/i.php?title=Special:Translate&filter=&group=ext-loginnotify&task=custom&language=it&action=translate

The original strings are in the code: https://github.com/wikimedia/mediawiki-extensions-LoginNotify/blob/master/i18n/en.json Did you want to edit those?

What's the `{{int}}` magic word for? NKohli (WMF) (talk) 20:34, 21 August 2017 (UTC)

Thanks for TransleWiki link.

I have edited the help page to use {{int}} magic word (which transclude interface message in user language). Pols12 (talk) 14:26, 23 August 2017 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Add some information about success login from new device

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

Hi. Could you do this, please? Thank you. IKhitron (talk) 17:59, 18 August 2017 (UTC)

What do you mean? The feature is there and you'll get a notification if you turn on the preference in Preferences > Notifications tab. NKohli (WMF) (talk) 20:30, 21 August 2017 (UTC)

Sure, but I couldn't find anything about that on the help page. Thank you. IKhitron (talk) 20:37, 21 August 2017 (UTC)

My apologies. That page is outdated. I'll get it updated soon. The correct information is available on https://meta.wikimedia.org/wiki/Community_Tech/LoginNotify

It doesn't issue a notification for successful login because then the attacker can see it and change your password as the notification prompts. That's why only emails are allowed for successful logins. NKohli (WMF) (talk) 21:56, 21 August 2017 (UTC)

Thank you. IKhitron (talk) 22:04, 21 August 2017 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Edit translate tags to correctly surround headers

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

Currently we can’t edit section 3 because of bug T134194. I am not translate admin, so I can’t do it, but it seems applying recommendations about translation administration would resolve the problem. Can anyone do it? Pols12 (talk) 14:32, 23 August 2017 (UTC)

Hi @Pols12, this problem isn't related to Login Notifications. You should comment on that ticket with your suggestion. Thanks. NKohli (WMF) (talk) 17:00, 23 August 2017 (UTC)

When you see that error for editing a section, the easy workaround is to just edit the entire page at once.

I've fixed those instances, and re-marked the page for translation. Thank you for your improvements to the docs. :) Quiddity (WMF) (talk) 17:07, 23 August 2017 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

IP address of unknown device

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

Hello all- Anyone know if there's a way to find out the IP address of an unknown device from which someone has tried to log in to our account? Please let me know if this is not where I should be posting this question. Thanks. ~ Eric (talk) 21:36, 25 August 2017 (UTC)

Hi. According to the privacy policy of our projects, the IP address is confidential information and hence we cannot reveal that in the notification. We might in future think about revealing an approximate location of the login but that's also uncertain. NKohli (WMF) (talk) 21:44, 25 August 2017 (UTC)

Sorry but that is a ridiculous policy. I.P addresses don't really reveal much at all without legal access to the ISP's customer records and they're not about to give us that. Not to mention Google has been revealing I.P. of ALL successful logins, and approximate locations of failed attempts for years. Knowing the IP allows me to determine whether I recognize it or not. If I do, I know it's not a problem. If I do NOT, then I know it's an issue and something needs to be done. Simply offering for us to change the password on a failed attempt is utterly useless. If they already FAILED, then my password is pretty good. If you're really that concerned about revealing IP's (an archaic position IMO), then change the login page to stop using usernames, which are publicly available across the entire site, to require registered email addresses instead. That makes a lot more sense to me since email is NOT publicly accessible. The way the system is now, where I get an email telling me there was a failed attempt, but all I can do is change the password they already couldn't figure out, is about as useful as an email telling me a 7-11 somewhere in East Podunk Australia was held up and the would be robbers got away with nothing. It's just silly.

Not to mention you guys already publicly post EVERY IP of anonymous editors! So to do that on the one hand, then when it comes to someone trying to break in, suddenly it's a security issue is just ludicrous. GoneForGood (talk) 18:34, 3 May 2018 (UTC)

Hi. I point out below in this thread that we got legal to agree to changes and there is ongoing work to bring this feature to users. NKohli (WMF) (talk) 21:29, 3 May 2018 (UTC)

totally agree. Could not agree more. Well said. ~ alacarte (talk) 20:04, 3 May 2018 (UTC)

Ain't the IP addresses of the person trying to log into our accounts displayed to us? We already receive the IP data when someone try to reset our passwords. This should be the same here. If the person trying to enter an user account that is not theirs do not want their IP addresses exposed to the account owner he should not try to log in into that account. —MarcoAurelio (talk) 19:52, 28 August 2017 (UTC)

> We already receive the IP data when someone try to reset our passwords. This should be the same here.

That's a good point. I didn't remember that. Okay, I'll poke some security/legal folks and see if we can get the IP address from where the attempted login happened to be displayed in the notification. NKohli (WMF) (talk) 20:10, 28 August 2017 (UTC)

@NKohli (WMF): Hi. I've filed phab:T174388 for this. Best regards. —MarcoAurelio (talk) 20:14, 28 August 2017 (UTC)

As for recording that, I don't think that that data is in CheckUser table but I could be wrong. CheckUser stores IPs when an IP requests a password reset but AFAIK it doesn't do the same for attempted logins. NKohli (WMF) (talk) 20:16, 28 August 2017 (UTC)

I don't know, then, why this feature went out without proper CheckUser integration for proper anti-abuse and anti-harassment purposes. I'm a bit dissapointed at that to be sincere. While LoginNotify is certainly a good idea, as it stands now it only gives some FUD to users receiving notifications and won't let CheckUsers/stewards nor the very user try to counter the abuse because a) the "intruder" IP address is not even exposed via email on successful logins from unknown devices and b) abusive login attempts ain't (citation needed?) recorded in the RC or CU table so we need to rely on ops people to browse the database logs to help in the investigations. Currently it's something like "hey, somebody (tried|did login) your account, but we won't tell you no more about that". Regards. —MarcoAurelio (talk) 20:24, 28 August 2017 (UTC)

In summary, I think we lack here:

• IP info data should be visible:
  • for unsuccessful login attempts, maybe to the user or to the checkusers should we want a more conservative approach.
  • for successful logins on unknown devices, on the email notification sent to the registered email of the "hacked" account.
• Proper CheckUser integration so unsuccessful login attempts and successful logins from unknown devices are recorded for bettering anti-(abuse/harassment).

Fortunately the extension is in active development so we can have this fixed if people thinks it's a good idea.

Regards. —MarcoAurelio (talk) 20:33, 28 August 2017 (UTC)

How would you counter that anyway? Even if you came to know the IP address? Complain to an admin to block them? Not everyone does that. The main idea behind the feature was to make sure you know when your account is under attack and you can make sure you have a strong password/2FA.

Don't forget you can turn it off in your preferences if the notifications are feeling more like spam to you. NKohli (WMF) (talk) 20:34, 28 August 2017 (UTC)

I don't think that "not everyone does that" is a valid statement for this possible overlook.

Not all vandals are smart enough to use some techniques I won't mention to fool admins/checkusers in their work. In any case, I think it is in the best interests of the owner of the account to fully know the activity happening on their accounts, and if it is about the security of their account, more. If someone maliciously tries to log in into your account, I think that you ought to know who. It happens on OTRS, on several other Internet websites, and here when doing password resets.

As things stand now, 2FA is only avalaible for users with elevated user rights and users requesting that it be manually enabled by the stewards on their accounts. And even for those that are allowed to use 2FA, it is not mandatory.

Regards. —MarcoAurelio (talk) 20:49, 28 August 2017 (UTC)

Three questions:

• Even if you do come to know the IP address that attempted to log in, what would you do?
• Is the fact that there was a login attempt from the IP a sufficient ground for blocking the IP address?
• Would maybe knowing the approximate location of the attempt be more useful to people? (I don't imagine a lot of people know what IP addresses are or how they work) NKohli (WMF) (talk) 21:01, 28 August 2017 (UTC)

In answer to your three questions (enwp CheckUser here):

• If I know that an unusual IP address is trying to log in to an account without authorization, I can find out if that IP or range is trying to do the same to other users. This was useful to us earlier this year during the mass attack on administrator accounts.
• Yes, if they're trying to hack into more than one account. I hardblocked an IP just last night that successfully managed to gain access to the account of a longtime enwp contributor.
• If I know the IP, I can geolocate it. I don't see the use of telling me geolocation, which would require the software to go get the geolocation and then present it, when I can just get that from the IP itself.

I believe Marco is coming from his CheckUser point of view instead of that of a user. Present the IP to the end user or not, but it really needs to go into the CheckUser tables so we have it if we need it. KrakatoaKatie (talk) 21:20, 28 August 2017 (UTC)

+1 IKhitron (talk) 22:02, 28 August 2017 (UTC)

Thank you, @KrakatoaKatie. This is helpful. I'll bring it up when my team discusses work for the next sprint and we'll see what we can do about this. NKohli (WMF) (talk) 21:58, 28 August 2017 (UTC)

Thanks to all of you for discussing this. I keep getting notifications of login attempts, and I'm curious to know where from. Eric (talk) 12:02, 29 August 2017 (UTC)

@KrakatoaKatie telling the geolocation may not be necessary for advanced users that know how to geolocate (could still be convenient, though), but for people that are not technical, actually giving out a location would help. It's quite different that the attempt comes from Nigeria than from your vacation location (unless it's in Nigeria, of course!) Platonides (talk) 23:43, 3 September 2017 (UTC)

Hello all- FYI, the notifications continue every few days, across multiple wikis. Today's notification e-mail was one minute apart from a password reset originating at [https://tools.wmflabs.org/whois/gateway.py?lookup=true&ip=2405%3A204%3A7148%3A957C%3A0%3A0%3A23F5%3A98AD an Indian IP]. Eric (talk) 10:49, 29 September 2017 (UTC)

While it may be annoying, assuming you have a strong password, those attempts should be fruitless. What would your expectations as a user of this feature be? Platonides (talk) 23:04, 29 September 2017 (UTC)

I think it would be useful to know if the attempts are all coming from the same IP or location. Then I suppose there might be a procedure for requesting an admin to block those IPs. It's remarkable how many messages I'm getting. Eric (talk) 09:37, 1 October 2017 (UTC)

IPs cannot be blocked for attempting to log in, unfortunately. We can do edit blocks for them but we can't stop them from accessing the login page. NKohli (WMF) (talk) 18:50, 1 October 2017 (UTC)

Ok, thanks for the info. I'm amazed at how the notifications keep pouring in. I wonder if someone's got it in for me?? Eric (talk) 22:19, 2 October 2017 (UTC)

@Eric, you have a really common username. I would guess they are many different people trying to enter into "his account". While it may seem obvious that logging in as "Eric" to a site they have never been before won't work, it's not that uncommon. And, given the sheer popularity of Wikipedia, even a tiny percentage of naive Erics could produce a noticeable amount of bad logins. Platonides (talk) 23:07, 2 October 2017 (UTC)

Thanks for informing me.

I never try to login to my account from another IP or from another device.

User:HKTHC HKTHC (talk) 12:56, 31 October 2017 (UTC)

I agree it would be nice to know the time and location and/or IP of the failed login. The name of the device would also be helpful (e.g. what if this was just my cell phone?). Given this information I would then be able to determine if this was me and I had simply forgotten my password temporarily, or if someone else had visited the website after me (i.e. on a public computer), or if this was indeed a fraudulent attempt. Dryphi (talk) 09:31, 30 January 2018 (UTC)

Actually, I don't see why could not the developers give us the device model, and if possible, even the os. IKhitron (talk) 11:10, 30 January 2018 (UTC)

Update: Hello all. The failed log-in attempts are still occurring regularly all these months later. Sometimes they subside a bit, sometimes they come in waves from multiple wikis. This morning my inbox has 3 messages from a span of 7 hours regarding multiple attempts to log in (en.wp, fr.wp, Commons), and a fourth regarding a password reset request (Commons, 1 minute after the failed log-in notice). It feels like harassment, though I agree with Platonides' reasoning that it likely is not. Still, the volume of messages that I've been receiving for 5 months now would seem to support granting admins the ability to research such cases. Does anyone know if any kind of CheckUser functionality is being enabled to this end? Thanks in advance for any info.

Eric Eric (talk) 17:42, 30 January 2018 (UTC)

Hi all - work on this is ongoing. A volunteer developer, Huji, has been working on this. It's going to take a while and I will continue to report back as things progress. Thanks all for your patience. :)

If you want to track it on Phabricator, here's the ticket: https://phabricator.wikimedia.org/T174388 NKohli (WMF) (talk) 19:06, 20 February 2018 (UTC)

Thanks for the update and link, @NKohli (WMF)! Happy to see that someone is working on this.

Eric Eric (talk) 20:18, 20 February 2018 (UTC)

Update FYI: the frequency of notifications has increased the past couple weeks, coming from multiple wikis (en, fr, es, zh, Commons). Today there were 12 simultaneous notifications from es.wiki. Eric (talk) 02:21, 24 April 2018 (UTC)

Eric, could you tell me something, please? Does this happen when you've been logged in on different devices, on different OS, on different browsers? Is there a possibility that something disturbs normal cookies work, as not enough place or some read-only problem, or even cookies turned off accidentally on device preferences? Thank you. IKhitron (talk) 10:00, 24 April 2018 (UTC)

Hi @IKhitron- No, if I understand your question correctly, I don't think it's the result of logging in on other devices. It's very rare that I am on a wiki other than at my desktop. The notification e-mails* come in both from wikis where I'm active and those where I'm not -- I'm never on zh and very rarely on es -- if that sheds any light. And I don't think it would be cookie-related. I haven't made any wiki-related cookie adjustments in my browser (Firefox these days, Vivaldi for several months the past year). Thanks for checking in. Let me know if I can give you better info.

*I got 18 of these e-mails in rapid succession last night:

Hubo 18 intentos fallidos de acceder a tu cuenta desde un dispositivo nuevo. Asegúrate de que tu cuenta posea una contraseña segura. Eric (talk) 12:59, 24 April 2018 (UTC)

Well, User:Eric, I'm very sorry for my poor English. I believe that the problem can happen if you work most of the time on the computer. And as you say, "It's very rare that I am on a wiki other than at my desktop". So, the problem can be in this particular desktop. IKhitron (talk) 13:24, 24 April 2018 (UTC)

Hi @IKhitron - No, it's not your English, it's my comprehension! This topic is well out of my area of expertise.

But what little understanding I have makes me wonder how an issue with my computer or browser could be causing these notifications to be sent out to me. Are you saying that it may be that my computer is randomly re-logging in and being seen as an unknown device by the various wikis? If I'm never on the Chinese or Spanish wikis, could my computer still be pinging them with log-in attempts? And why would the log-in attempts fail if I'm continuously logged in from my main computer with a universal log-in? Eric (talk) 13:45, 24 April 2018 (UTC)

No, Eric, I do not say your computer does it all by itself. But maybe a problem, or a part of it least, created by your computer. If wiki tryes to save cookies on your computer, and does not succeed, or they are saved wrong, and next time on login wiki reads them and assumes something that did not really happen, it can cause problems. IKhitron (talk) 13:51, 24 April 2018 (UTC)

Well, it's beyond my ken, but I suspect that since the issue has been occurring for months, including during a several-month period during which I used Vivaldi and not Firefox, it must be something other than cookies. I just deleted all wiki-related cookies from Firefox, so we'll see what happens in the coming days. Thank you for your thoughts on this, @IKhitron.

Oops, wiping the cookies apparently logged me out! 72.93.145.225 (talk) 14:38, 24 April 2018 (UTC)

It's not the only possibility. For example, User:Eric, I experinced problems for a while because there was not enough memory on my device, and not all the cookies were saved. IKhitron (talk) 14:42, 24 April 2018 (UTC)

@Eric, my guess would be that 'Eric' is a common enough username that people and bots would randomly try to login to your account, like Platonides said. This isn't unique to Wikipedia and happens on a lot of websites, but we're one of the few showing you login attempt notifications which isn't as common and also logins are not tied to emails which have much less of an issue. :(

I think we had a similar complaint from another user with a very popular username.

My advice would be that you turn off the notifications after ensuring you have a good password. We are meanwhile working on a feature to let you know what IP address the attempt happened from so you can ensure that it wasn't you accidentally triggering it, which happens often. NKohli (WMF) (talk) 18:08, 24 April 2018 (UTC)

@NKohli (WMF), thanks for the info! I think I will turn off notifications. Eric (talk) 22:02, 24 April 2018 (UTC)

Eric, if you are an admin on any Wikipedia, perhaps you can try the 2SV? I am thinking about your account security, and as you are going to turn off notification(s). Titodutta (talk) 18:29, 3 May 2018 (UTC)

Hi @Titodutta- No, I'm not an admin. Yes, that's why I originally posted, preferring to keep in place the notification option for what I would think would be the rare occasion where a would-be miscreant might attempt to log in as me. I can't imagine who would want to break in and assume the identity of a crusty old copyeditor! Eric (talk) 01:33, 4 May 2018 (UTC)

Many web sites disclose the IP address of the attempted attack. I would hope that Wikipedia would consider doing the same. If I don't recognize the IP address then could then choose to make it public to see if others are getting attacked from the same source.

At present, all I know from the notification is the approximate date/time that someone or something may have attempted to sign in as me on a web site somewhere. I don't know if notification is immediate or if can or will be delayed and so even the date/time is approximate.

It's not clear from the notification if Wikimedia or Wikipedia's security group is also watching the failed login attempts or if they 100% rely on end-users to manage their own security. For example, if IP address 1.2.3.4 is attacking many accounts then ideally the system recognizes this and will always return "login failed" even if 1.2.3.4 happens to guess the correct password for an account. Related to this is that if a concerted attack is recognized then you likely do not need to notify end-users for each instance of the attempted attack.

I would also like to know where the attack was attempted. In other words, which wikimedia or wikimedia site the login attempt was on? Wikipedia/Wikimedia has a large attack surface. I use many of the sites and so it may helpful to know which site the login attempt was on.

I also would like to know the password the person tried assuming that Wikimedia/Wikipedia knows what it is. It's possible the password is hashed on entry and that only the hash is known. If you know the attempted password then it likely should not be in the notification message but is something that I'd like to be able to retrieve, possibly on a web page where I'm force to re-enter my own credentials. Knowing the attempted password would be of use to someone like me that uses a different password for every web site or service I deal with. If I see that someone attempted PmkE9gCH85 I'll look to see where I used that password and will know that other site is likely compromised. and can notify them.

FWIW, if you have access to the passwords being attempted then you can build and maintain a dictionary of the passwords and run that internally against accounts. End-users should not be allowed to use passwords that are known to be in the attack dictionaries. Marc Kupper (talk) 17:20, 3 May 2018 (UTC)

I got another such email. Just one sentence does not provide sufficient information, and makes me more puzzled about what to do. Earlier I found AWB etc tools were triggering this notification.

If I get a notification like "someone from "this" place or with "this" IP" (yes, I have read the discussion above) tried to login, I'll have reason to be careful, as I know it is definitely not me. Titodutta (talk) 18:26, 3 May 2018 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Login attempts and check user IP?

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

I received notifications of 3 failed login attempts, the timing of the logins (which I assume is the time of the warnings) made me suspect that it is another specific user I am aware of. Is it possible to check, say, by comparing the user's IP address with the one attempting to login into mine, and what measure can be taken to ensure that that user does not try it again? I know it is possible to do a check user when someone is suspected of sockpuppetry but they may not have a record of login attempts. Hzh (talk) 10:07, 27 August 2017 (UTC)

Hi @Hzh. There's no way to stop somebody from attempting to log in to your account. We cannot make the IP address of the attacker available because of our privacy policy. The best thing to do is to have a very secure password and turn on 2 factor authentication if you're concerned about your account being hacked. There are bots on the web that randomly try to login to thousands of accounts at the same time, pretty much all the time. This feature is designed to help you know when your account is under attack and you should make sure you have sufficient protection. Thank you. NKohli (WMF) (talk) 17:54, 28 August 2017 (UTC)

The question is not about making any IP address available, but checking against another user I suspected of doing this, and not a random bot. I think they do check IP addresses when they want to confirm if someone is engaging in sockpuppetry, and no IP addresses are revealed in their investigation. I would assume by your reply that there is nothing set up to check if one user attempting to hack into another, and that I find odd because if a user is trying to get into someone else's account it is likely to be for malicious purposes. Presumably we would have to wait until the attempt to hack into another user's account is successful? Hzh (talk) 19:45, 28 August 2017 (UTC)

Yes. It is possible to see if the IP addresses that were recorded trying to log into your account matches any of a registered user. I think those are sent to you by email or on-wiki notification, right? However I'd made the request in private to the CUs of your project (or the stewards should your project does not have local checkusers), because due to privacy policy limitations we won't be able to publicy link registered accounts to IP addresses except on a limited set of circumstances. —MarcoAurelio (talk) 19:50, 28 August 2017 (UTC)

Addendum: so apparently at Help talk:Login notifications#h-IP_address_of_unknown_device-2017-08-25T21:36:00.000Z they say that the IP addresses ain't sent to the users. In that case unless this kind of actions are recorded in the RC or CU table, we would not be able to compare. —MarcoAurelio (talk) 19:53, 28 August 2017 (UTC)

I am receveing 15 notifications about failed login attemps from 9 days, what should I do? FrankCesco26 (talk) 16:29, 3 September 2017 (UTC)

Platonides, pay attention. IKhitron (talk) 16:32, 3 September 2017 (UTC)

FrankCesco26 you should ensure that you have a strong password, so they won't be able to break into your account. Also, you may be able to enable two-factor authentication in which case even discovering your password won't allow them to log in. Platonides (talk) 19:22, 3 September 2017 (UTC)

How can I activate it? FrankCesco26 (talk) 20:32, 3 September 2017 (UTC)

@FrankCesco26 you would do it from Special:Two-factor_authentication, see [1] In your case, it seems you don't have the rights to use it on any project. Platonides (talk) 23:47, 3 September 2017 (UTC)

He can request to be added to a group that allows 2FA in m:SRGP. —MarcoAurelio (talk) 11:08, 4 September 2017 (UTC)

What's the reason behind 2FA not being available to everyone? NKohli (WMF) (talk) 16:40, 4 September 2017 (UTC)

I am not sure. It is currently only avalaible to "privileged" groups. A proposal to expand the feature to all groups is being discussed on Meta-Wiki and at a Phabricator ticket I cannot remember right now. Please note that this was emergency deployed shortly after the OurMine hacking attack campaign, and my guess is that this was done to protect accounts with sensitive accesses from being compromised and that they decided not to roll this out to all users for now because there might be still issues pending to resolve (like enabling other options to recover your account should you mess with your scratch codes, etc. I don't know who you can ask for further information though. Regards. —MarcoAurelio (talk) 17:12, 5 September 2017 (UTC)

How can I request it? FrankCesco26 (talk) 10:45, 5 September 2017 (UTC)

FrankCesco26: Hello. Please post a request at m:Steward_requests/Global_permissions#Requests_for_other_global_permissions or, if it is easier for you, leave me a message requesting to be added at my talk page at m:User talk:MarcoAurelio. Regards. —MarcoAurelio (talk) 17:16, 5 September 2017 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

What is a strong password?

I would advice to have a paragraph on the help page to give advice about defining a strong password. That would help users who are not familiar with that concept. Trizek_(WMF) (talk) 09:51, 29 August 2017 (UTC)

correcthorsebatterystaple!

+1, good idea.

We have these existing options, that could be copied (with attribution) or adapted:

• "Select strong passwords -- eight or more characters long, and containing letters, numbers, and punctuation." - m:Security/Password reset
• long and detailed page, with one specific section, at m:Make sure you have a password
• "The strength of a password is a function of length, complexity, and unpredictability" - w:en:Password strength
• "As a rule of thumb, a password that is reasonably long, with a mix of upper and lowercase letters and numbers, and not mostly made up of dictionary words or names or personal information (date of birth, cat's name, etc.) is likely to be reasonably strong for everyday use. Passwords that consist of just lowercase letters can also be reasonably strong, but they must be significantly longer" - w:en:Wikipedia:User account security Quiddity (WMF) (talk) 22:39, 29 August 2017 (UTC)

Actually, the documentation page should tell – when possible – if the current password seems strong enough. This might be implemented by something like adding a boolean "strong_password" which is set at the same time as the password, with a default value of nil which means "don't know". You might also try to run john the ripper or something like that to fill this boolean, but that might be a huge computation load for a very doubtful benefit. Psychoslave (talk) 22:02, 26 December 2017 (UTC)

I've updated the page.

The Special:CreateAccount page should definitely have a way to get say to user how strong the password is. I've been able to create an account with "toto" as a password... There is a ticket for that. Trizek_(WMF) (talk) 15:17, 16 January 2018 (UTC)

Successful logins triggering notifications

After just logging in for the first time in awhile, I got a notification that "Someone (probably you) recently logged in..." etc. (Popping up after I had logged in, so that was the cause of it.) Based on the description of this feature and the 'Add some information about success login from new device' thread below, I'm pretty sure this is not intended behavior? (note: I don't have successful-logins emails enabled, either.) The Bushranger (talk) 09:18, 2 September 2017 (UTC)

You're right, it's not intended. This bug is being tracked here: T174220. We're working on tracking down the cause and getting it fixed. Thanks for the report! NKohli (WMF) (talk) 21:09, 2 September 2017 (UTC)

No problem. :) As a follow-up, after several logins in the spanning time without it happening, I just had it happen again, so this is still a continuing issue. The Bushranger (talk) 05:34, 21 September 2017 (UTC)

Same here. In my case, I had copied and pasted the password but this triggered a rejection, yet when I typed the identical password and logged in successfully, I started getting notifications that someone had attempted and failed to access my account. I can't get rid of this notification now, and don't want to change my password, since there was no breach of security in the first place. ~ Chrisdevelop (talk) 00:06, 2 April 2018 (UTC)

Click on the blue circle in top right of the notification to clear it. SilkTork (talk) 09:09, 4 May 2018 (UTC)

Add instructions on what to do if you already have a strong password

The section on "What should I do?" tells you that you should have a strong password, but it doesn't tell you what to do if you already do. Even a mention of "that's it" would be good. GPHemsley (talk) 22:54, 5 September 2017 (UTC)

Thanks for the idea. I added this sentence: "Even if you do have a strong password, you may want to change passwords anyway, if you suspect that someone else has tried to access your account."

Do you think that's helpful? DannyH (WMF) (talk) 17:03, 6 September 2017 (UTC)

I think that's helpful, but I don't think it fully addresses my concern: Basically, ensuring you have a strong password is the only action you can take as a user who is receiving these notifications. That point should be made explicit, I think, or else the user will be left asking "OK, now what?" GPHemsley (talk) 01:01, 7 September 2017 (UTC)

Hmm, what would you suggest? DannyH (WMF) (talk) 17:16, 7 September 2017 (UTC)

I'm not sure, as I don't have a full understanding of what causes these notifications. Jumping off from some other threads here, maybe a suggestion as to the possibility that your devices are attempting to log in for you while you are traveling? GPHemsley (talk) 21:12, 8 September 2017 (UTC)

I think that the current sentence is very misleading.

"Even if you do have a strong password, you may want to change passwords anyway, if you suspect that someone else has tried to access your account."

Someone who already has a strong password will not in any way benefit from changing their password unless they already got hacked.

Also, it probably shouldn't be plural? (passwordS?!) Or does Wikipedia support a multi-password login mechanism?

There was a paper out there about this very topic but I can't find it now. I probably have a copy on my drive, somewhere, but with a good 1Tb of data... Oh well. Anyway, the definition of a "strong password" is also extremely blurry. A very long passphrase can be a lot better than a "super complicated" 8 chars password. Alexis Wilke (talk) 23:32, 3 May 2018 (UTC)

Thanks for warning me, but to contact me this way every time I make a typo in my password is an exaggaration we do not like. Some people may get scared to death (sorry for doing the same LOL) or insulted by thinking "I know my password is so strong that I mistype it myself sometimes".
Kind regards from (temporary) Egmond aan Zee, Klaas `Z4␟` V:  07:00, 4 May 2018 (UTC)

BTW: can you tell me what IP-address tried to enter in a WMF-site in my (user)name? Klaas `Z4␟` V:  07:16, 4 May 2018 (UTC)

Hi KlaasZ4usV -- over the last day, there was a large-scale attempt to break into random Wikipedia accounts. The vast majority were unsuccessful, and the Wikimedia Foundation's security team has stopped the attacks and communicated with the small number of people whose accounts may have been compromised.

There's more information in this post by the Director of Security on the Wikimedia-L mailing list. DannyH (WMF) (talk) 17:47, 4 May 2018 (UTC)

Notifications

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

Is there a way to deactivate these notifications and if yes, how can I deactivate them? They are annoying. --~ ZdBdLaLaLa (talk) 17:10, 14 October 2017 (UTC)

Sorry about that. You can disable them in Preferences > Notifications > "Failed login attempts" and "Login from an unfamiliar device". Turn off the checkboxes. NKohli (WMF) (talk) 17:19, 16 October 2017 (UTC)

https://www.youtube.com/watch?v=nsJsg3HVRM8 Namonggtq4 (talk) 12:24, 18 October 2017 (UTC)

http://abc.go.com/feedback Namonggtq4 (talk) 12:24, 18 October 2017 (UTC)

Thanks for informing me.

I never try to login to my account from another IP or from another device.

User:HKTHC HKTHC (talk) 12:57, 31 October 2017 (UTC)

well, can i have the wiki pedia notifications through message on my phone number? any one help Kava Hg (talk) 05:54, 2 November 2017 (UTC)

@Kava Hg That is not possible. Sorry. :( NKohli (WMF) (talk) 17:59, 6 November 2017 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Opening the mobile app causes failed login notifications

I have the Wikipedia mobile app installed on both my phone and my tablet (both Android devices), and I have seen a significant uptick in the last couple of months of notifications of a multitude of failed login attempts that seem to coincide with my having opened the app, perhaps with a less-than-reliable internet connection. Is this a known issue? GPHemsley (talk) 23:25, 31 October 2017 (UTC)

We haven't heard this before, thanks for your report. I created a bug ticket for it, if you want to follow it: phab:T179518

I have a question -- There's two types of notifications: are the ones you're getting about failed login attempts, or successful attempts from an unfamiliar device?

If the app is triggering them, I would think the "successful attempts from an unfamiliar device" notifications would make more sense than the failed attempts -- but if you're getting failed attempt notifications, then there really is something odd going on here. :) DannyH (WMF) (talk) 17:49, 1 November 2017 (UTC)

Repeated notifications

I've gotten repeated notifications about failed logins for my account on German Wikipedia for days now. Is there anything else I can do about it besides having a secure password? Cuchullain (talk) 18:44, 14 November 2017 (UTC)

@Cuchullain that is sufficient. You can turn off the failed login attempt notifications if they get too annoying. NKohli (WMF) (talk) 18:56, 14 November 2017 (UTC)

I've also received repeated notifications (sometimes 5 in half an hour) . This past week I've received 20 notifications. I've got a strong password but it concerns me that there is the possibility to make so many attempts. Gerardduenas (talk) 08:20, 5 December 2017 (UTC)

@Gerardduenas you need not be concerned. The possibility to make attempts is on every website and not something we can control. NKohli (WMF) (talk) 12:12, 5 December 2017 (UTC)

There are some control that can be done, and I think are actually done, like blocking further attempt from an IP/device to log on an account until some emailed link was consulted. I don't know the exact policy regarding this though, and adding some link about this topic on the Login notifications page would be interesting I guess. Psychoslave (talk) 21:50, 26 December 2017 (UTC)

Absolute Relentless Notifications

Go on. Who is the joker who thought SUL, failed login notifications and having to disable them on each and every wiki was a clever thing? What a shower of utter shit. It's no wonder I can't be arsed to contribute to this bollocks any more. Maybe Sanger and his distributed encyclopedia needs a hand. Utterly dim witted. Pedro (talk) 23:02, 13 December 2017 (UTC)

Thanks for the glorious description, @Pedro. To answer your question, it was a community decision to enable the notifications on all wikis and not the way we deployed it originally. You may wish to talk to @IKhitron about this. NKohli (WMF) (talk) 03:44, 14 December 2017 (UTC)

Hi @Pedro - I'm sorry you're getting too many notifications. Can you give us a little more information about what's happening?

What I'd like to know is: are you getting multiple notifications from the same wiki, or from lots of wikis? Are they notifications about other people trying to log in with your account, or are they about you logging in from an unfamiliar device?

Any details you can give us would help. DannyH (WMF) (talk) 18:18, 15 December 2017 (UTC)

Disclose IP address

I suggest that this tool is basically useless (at least is useless to experienced users) unless there's notification of the IP address from which the login attempt has been performed.

Today (26 December 2017) I received 7 (seven) e-mails in a row from 2:45 UTC+1 until 3:03 UTC+1 that read that on en.wiki an anonymous user had tried to log in (my home wiki is it.wiki, as a matter of fact). Later in the afternoon I received same notification that on zh.wiki there had been three attemts from 15:57 UTC+1 to 15:58 UTC+1.

Rather than recommending to an established (13+ years) user (who happens also to be an administrator on Wikimedia Commons :-) ) to adopt a strong password, could this tool provide them with the IP of the lamer who tries to get in with someone else's credentials? Blackcat (talk) 17:54, 26 December 2017 (UTC)

What would you do with this IPs? Psychoslave (talk) 21:45, 26 December 2017 (UTC)

Well, first of all to determine where the attempt comes from.

Then I have a base to report to the law enforcers this attempt, because in our legislative system both attempting to enter to an online system with false or stolen credentials and attempting to steal the said credentials is a crime. Blackcat (talk) 21:56, 26 December 2017 (UTC)

Ok thank you for this information. Psychoslave (talk) 22:31, 26 December 2017 (UTC)

Hi @Blackcat, there is a ticket for this (T174388) that is currently being worked on by a volunteer developer. We've received similar feedback from other users and are keeping an eye on the progress of this task. Thanks. NKohli (WMF) (talk) 11:44, 29 December 2017 (UTC)

yes, @NKohli (WMF), thanks, the problem is that the developpers are lost in pointless issues. Technically can be done, is not up to them to worry about the privacy issues , I don't know what to do with a warning that doesn't explain me which IP has attempted to steal my credentials, and that doesn't allow me to report it to the law enforcers. Blackcat (talk) 22:11, 29 December 2017 (UTC)

are there any news on this subject ? A1000 (talk) 11:54, 4 May 2018 (UTC)

Basically they don't want to disclose IPs. Blackcat (talk) 12:30, 4 May 2018 (UTC)

@A1000 It's still under development. For the login attempt notifications you are seeing currently, it is a large-scale attack and the Operations team knows and is working on it. Please see the statement made by the security team yesterday for more information. NKohli (WMF) (talk) 17:47, 4 May 2018 (UTC)

Thx for info, i am one of those guys who have logins at several wikis and use different computers to connect them what means i have no enought information from the current mail to see if there is a problem or if i triggert a warning accidently A1000 (talk) 11:01, 5 May 2018 (UTC)

I'd also like to see the IP address as I've been getting failed login attempts: not many, but enough to spook me. Wikipedia isn't afraid to show people's IP address when someone edits something if not logged in, so why the reticence if someone's doing something wrong? Vometia (talk) 10:47, 7 May 2018 (UTC)

Because they don't really want to solve the issue. Blackcat (talk) 11:31, 7 May 2018 (UTC)

Alternatively, if there's some kind of privacy concern, give us the rough location of where the attempt is coming from, or the first few numbers of the IP address. I kept getting mails like "Someone from China tried to log in on your account" on another website, which made it obvious to me that my account name was just on some list on a Chinese hacking site that was used in brute-force attempts. Knowing that would reassure us that we just need a strong password and can otherwise ignore it. If it says it's from my rough area, I'd assume it's a problem on my end like the cookie accidentally getting deleted. Prinsgezinde (talk) 13:39, 7 May 2018 (UTC)

Bureau for the Complication of Simple Issues. And they are not even Italians.... Blackcat (talk) 15:10, 7 May 2018 (UTC)

We would love to send people the IP address, but this is more complicated than it sounds, mainly due to privacy issues and the GDPR. Discussions are ongoing, but unfortunately we are not going to be sending the IP addresses in the immediate future. If the notifications aren't useful to you because of that, feel free to turn them off in your preferences. Sorry we don't have a better solution at the moment. Ryan Kaldari (WMF) (talk) 09:51, 19 May 2018 (UTC)

Ryan, you are an intelligent person. You understand by yourself that a warning of failed attempt access without the ip is completely useless.So you'd better remove that tool at all. Blackcat (talk) 10:00, 19 May 2018 (UTC)

Reword the subject of the email about new login

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

For me the email subject reads "Login to MediaWiki as Kaartic from a computer you have not recently used". I guess using the generic word device might be a better alternative for computer. So the message would read "Login to MediaWiki as Kaartic from a device you have not recently used".

Just a suggestion :-) BTW, I'm not sure whether this is the perfect place to suggest this ;-) Kaartic ^[talk] 15:12, 1 February 2018 (UTC)

Isn't a phone a computer too? ;)

But I get your point. Thanks for the suggestion. I'll look into updating it. NKohli (WMF) (talk) 18:57, 1 February 2018 (UTC)

Not many people consider their mobile to be a computer though technically it can be called one. Also, I've seen the usage of the term "device" in messages like this by other services like Gmail so I thought it would be better to be consistent.

I do get that you get my point. Just adding some reason as to why I was suggesting this. :) Kaartic ^[talk] 06:01, 3 February 2018 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Using network address to claim a device is new ??

I'm being notified about login from a new device when I just log in from my usual device using a new network. The message claims I logged in from an new device not that I logged in using a new network(Login to Meta as Kaartic from a computer you have not recently used ...). Further, identifying a device using the network address doesn't seem nice idea to me. Network addresses aren't tied to the device so strongly. Also, it triggers lots of false positives as in my case.

Hope a better alternative was used to identify new devices correctly and appropriately.

Note: This all relies on the assumption that devices are identified using the network addresses. If that's not the case, please help me find why I see false positives. Kaartic ^[talk] 17:22, 1 February 2018 (UTC)

When we say device it's actually the browser. It checks for both browser AND IP address. It places a cookie in your browser so next time you login from same browser, it doesn't warn you. And in case of no cookie, it checks whether your account has previously performed any actions from the IP address you're logging in from. This is done by consulting the CheckUser table(s).

If you use incognito mode or clear your cookies manually AND change your IP address then you will receive this notification.

The language used is intentionally simple in order to not confuse people with complex jargon.

I hope this clarifies stuff. :) NKohli (WMF) (talk) 19:04, 1 February 2018 (UTC)

If you use incognito mode or clear your cookies manually AND change your IP address then you will receive this notification.

I was reporting this because I didn't satisfy the above condition. (I guessed you would be using cookies in some way). To be more clear I got the notification when I logged into a browser I use day to day. The only odd thing was I was on a new network. But Wait! I'm a user of multiple browser profiles. So, there's a possibility that I haven't previously logged into Wikipedia in the particular profile. So, there's a possibility that the cookie might be missing. But I do mildly remember logging into Wikipedia at least once on every profile I use in my browser.

To conclude, consider this "Stalled" until I'm pretty sure that I get notifications when I log into a browser profile that I've previously used. (I suspect the cookies are somehow vanishing surprisingly from my browser: T151770 ??) Kaartic ^[talk] 06:45, 3 February 2018 (UTC)

Failed attempt from an unknown device

In this case, how is it possible for me to find the IP address of the attempt source? Also, is it possible to which site the login was attempted, because I have global login. This is the first time I received such a message since I registered as a member. Currently, I test and work with two browsers, Firefox and Vivaldi, both in Windows and in Linux Mint. — Ineuw talk 00:23, 4 May 2018 (UTC)

@Ineuw Hi, this is a widespread login attempt attack happening to a lot of user accounts today. See discussion on the enwiki village pump. The operations team is aware of this and we have banned the bot(s) trying to do this. You don't need to worry about it if you have a secure password.

The feature to show users the IP address of the attempt is still in the works and not live yet, unfortunately. Sorry about that. :( NKohli (WMF) (talk) 00:59, 4 May 2018 (UTC)

showing the IP is one thing... we should also be shown the device name... that's what i'm more interested in since it is how i identify my devices... that would let me know if someone is trying to duplicate my device or, with the IP number, maybe i can find a lost or stolen device... Wkitty42 (talk) 04:28, 8 May 2018 (UTC)

@Wkitty42 Device name is private information which we do not store on our databases. We try to collect as little information as we have to, to maintain privacy for our users. If you want a feature to find a lost or stolen device, you can make use of features that Google and some other apps provide. NKohli (WMF) (talk) 17:09, 8 May 2018 (UTC)

Can't login anymore

Hey, Kante4 here. Yesterday i had a notification about a failed log in attempt and created a new password as adviced. But somehow i can't login with this. The e-mail i had here is old i think, which means i can't get a new one. Any advice how to get my old account back? 109.91.152.164 (talk) 08:28, 4 May 2018 (UTC)

In which way you created new password? Used reset or changes after login? wargo (talk) 08:52, 4 May 2018 (UTC)

On mediawiki after i got a message because of an failed attempt while i was not at home. https://www.mediawiki.org/w/index.php?title=Special:UserLogin&returnto=Special%3AChangeCredentials&returntoquery=&force=ChangeCredentials was the adress if it helps. 109.91.152.164 (talk) 08:57, 4 May 2018 (UTC)

And it was told to me that i should change one. It worked all good yestrerday after that but today i was logged out and can't login which either password. I requested a new one to my e-mail actual adress but that is the one i had in my preferences sadly. So not sure if one is sent or can't because it is not my one here. 109.91.152.164 (talk) 09:02, 4 May 2018 (UTC)

Maybe i should have not changed my password. 109.91.152.164 (talk) 09:07, 4 May 2018 (UTC)

Are you definitely no longer in control of your email address attached to this account? So Special:PasswordReset does not work? Have you checked your spamfolder? :) JSutherland (WMF) (talk) 22:31, 7 May 2018 (UTC)

Tell us some information about the log in attempt

It's always possible this is just a mistake or something we personally did. It's more useful for us to see some info, like the browser and IP geolocation (If not the IP address itself). This is how other sites do it, and I've definitely caught some times where it was just me.

If there is a way to get this info, please make it clearer. As is, I can't tell if my latest attempt is something I care about or not. The timing was weird. Trlkly (talk) 11:54, 4 May 2018 (UTC)

Yes, that would be very important. And perhabs, which Wiki* the login was.

I got the mail today and i feel very uncomfortamble. I looked at the the Wiki*, I use often, and there are no unknown posts. But the Wiki*, i do not use?? Riepichiep (talk) 03:38, 10 May 2018 (UTC)

Hi Trikly -- over the last day, there was a large-scale attempt to break into random Wikipedia accounts. The vast majority were unsuccessful, and the Wikimedia Foundation's security team has stopped the attacks and communicated with the small number of people whose accounts may have been compromised.

There's more information in this post by the Director of Security on the Wikimedia-L mailing list. DannyH (WMF) (talk) 17:49, 4 May 2018 (UTC)

Regardless, we should be able to see the browser/IP of the failed attempted logins. LaUr3nTiU (talk) 23:17, 4 May 2018 (UTC)

If the IP address is visible on a wiki edit page unless the user has an account there should be no issue with giving the IP of the attempted login to the owner of the account that has been tried. If it is their own IP they will know it and if it is from somewhere else they will need it to report it to the authorities. The information about the IP being used is not being made public - it is simply being reported to the owner of the account. Lots of other systems do that by saying "This IP tried to log into your account - if this is your own IP no further action is needed".

But also - if there is a known attempt ongoing it makes it less concerning to me than that someone is targeting me personally - for a site with issues about not having enough women and minorities, it would be good to know if a user is being targeted as a woman or a minority or that the whole site is being targeted. Antiqueight (talk) 14:07, 7 May 2018 (UTC)

I'll just add to the already numerous criticisms of this ridiculous "feature' added in 2017. You say multiple attempts have been made but give us no other information. What device? Is it my phone? Have I unknowingly tried to log in to Wikipedia several times on my phone and failed? Why would anyone want to break into my account?

Then you say change my password. Ha! If they tried to break into my account and failed then how would changing my password stop them from trying.

Why don't you stick to reviewing articles on Wikipedia. ~ Dangnad (talk) 18:04, 7 May 2018 (UTC)

Hi Dangnad -- there was a large-scale attempt last week to break into many random Wikipedia accounts. The Wikimedia Foundation's security team stopped the attacks, and posted information in this post on the Wikimedia-L mailing list.

It's stressful when you find out that someone's been trying to break into your account. I think in this instance, the notification feature successfully informed you that there was a problem, and it brought you here to get more information. :)

For me personally, the notifications were a good reminder to make my password harder to crack. Automated attacks like the one that happened last week run through a lot of word and number combinations, so it's good to be sure. DannyH (WMF) (talk) 18:22, 7 May 2018 (UTC)

Just like Dangnad mentioned, it would be really useful if we can get more details about the failed attempts. Was I drunk last night and I tried to login? Was it on my phone/desktop/laptop? Was it a different person from a different country trying to hack into my account? Just giving a random information and the assurance that the Wikimedia staff blocked the attempts if not enough. LaUr3nTiU (talk) 16:07, 9 May 2018 (UTC)

I want more informations!

Today I received "Multiple failed attempts to log in", but actually, this is not very useful for me.

I would like to know:

1 - which passwords had been tried? How close are the attempts to my password?

2 - how fast did the attempts come? Is there a program trying to guess my password or is it a human?

3 - Am I the only one or are there also other attempts on other accounts? Plenz (talk) 13:43, 7 May 2018 (UTC)

Hi @Plenz. Good questions! I'll try to answer them. For the first one, we typically do not keep track of that information nor can we reveal them. This is because is someone's username is 'Plenzz' and they misspell it and use their password, revealing that password to you could be a privacy violation of their account. For more information in general, you can look at this graph. It's a little tricky to decipher. The huge spikes you see are caused by a bot/program which is trying to login to thousands of wiki accounts per second. Your account is not the only one affected. As usual, when things like this happen, engineers in Wikimedia keep a close watch on it and block the programs so they cannot login, but we cannot stop them from trying to login anyway. And also, you can always trust enwiki village pump to have more information about these things if they happen on a large scale. NKohli (WMF) (talk) 17:54, 7 May 2018 (UTC)

If the password is available in the clear --that is, not Challenge–response authentication-- it would be interesting to have a check-passwd function which returns a number, rather than just a Boolean. For example, it could return the Levenshtein distance or variants thereof. While a 0 would mean "pass", positive distances, along with the number of attempts, could be used to estimate how close to guessing an attacker has gone. In other words, that would be a "real" password strength checker. Ale2006 (talk) 10:19, 10 May 2018 (UTC)

@Ale2006 That's an interesting idea. We'll look into that although it would probably be challenging to implement because we don't store passwords when an attempt is made. We simply reject the login if there is a password mismatch. NKohli (WMF) (talk) 18:08, 10 May 2018 (UTC)

I'd at least like to know what IP tried to log in, or where they logged in from. Or what device was used. That way I can find out if it wasn't just me. 72.199.184.243 (talk) 03:15, 14 May 2018 (UTC)

@Ale2006 If wikipedia is storing hashed passwords (as they should!) then it would be impossible for them to recover the levenshtein distance from a password login attempt. Storing the unhashed password gives minimal useful information, and opens up a large attack vector for quickly retrieving a large number of passwords. Jcdyer3 (talk) 15:23, 28 August 2018 (UTC)

The passwords are not stored in the clear. :) NKohli (WMF) (talk) 22:59, 29 August 2018 (UTC)

Is there any way shut this misfeature off?

My Internet Service Provider (ISP) changed the IP address on my high-speed cable modem last week, probably because the IP lease expired, and now I'm getting incessant email notifications of attempted logins from "an unknown device". IP leases expire after at most 7 months, or so, although they can be set to expire after shorter elapsed times. This same approach is being taken by Google, and last week they blocked no less than a dozen email accounts that I monitor for the same invalid reason. Monitoring IP addresses is simply not a viable way of screening for attempted break-ins. Wikimedia Foundation needs to shut this misfeature off, or provide a means for individual users to shut it off.  — Quicksilver^{T @} 19:00, 7 May 2018 (UTC)

You can turn it off in your preferences -- in the Notifications tab, you'll find "Failed login attempts" and "Login from an unfamiliar device". Sorry that the feature was annoying you. DannyH (WMF) (talk) 00:54, 8 May 2018 (UTC)

Thank you. Done.  — Quicksilver^{T @} 07:24, 8 May 2018 (UTC)

The article page needs to be updated

It talks about "n failed attempts" but we don't see any of that, we see "multiple". Aisteco (talk) 11:57, 10 May 2018 (UTC)

Change suggested password tips?

http://www.govtech.com/security/Widely-Used-Password-Advice-Turns-Out-to-Be-Wrong-NIST-Says.html says:

In 2003, when Bill Burr was a manager at the National Institute of Standards and Technology, he wrote guidelines for creating safe online passwords. The paper, memorably titled "NIST Special Publications 800-63," became the benchmark, its diktats followed by government agencies, corporations, universities and individuals.

Burr recommended creating passwords that were essentially weird nonsense words, chock-full of special characters and occasional capital letters and numbers. He also said people should change their passwords regularly. But he was wrong, and he admits it. "Much of what I did I now regret," he says.

It wasn't really his fault. At the time, he was mostly flying blind. He had to rely on common sense as much as technical expertise. Now, 15 years later and after major hacks of corporations such as LinkedIn and Twitter, computer analysts have the data to determine which kinds of passwords work and which don't. And so the National Institute of Standards and Technology has radically reworked its guidelines.

New recommendations from the National Institute of Standards and Technology call for people to create passwords that are "long, easy-to-remember phrases" -- a series of four or five words mashed together. This can be "harder for hackers to crack than a shorter hodgepodge of strange characters."

So, should we get rid of the advice that people should use Tr0ub4dor&3 instead of correcthorsebatterystaple? Banaticus (talk) 18:18, 18 May 2018 (UTC)

Will wiki support Google Authenticator ?

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

I think setting up a 2-Step verification will secrue our account, and making password attack less possible to success.

Google Authenticator based 2-Step verification is totally free and the methods are public as RFC 4226 and RFC 6238. Galaxy (talk) 07:04, 21 May 2018 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Constant attempts to login to my account

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

I've been getting very consistent messages that someone is trying to log in to my account the past 2 months or so. I'm getting notices several times a week now.

Other than having a good password, is there anything that can be done? Is it possible to get information about where the login attempts are being made? Peter Isotalo (talk) 10:06, 31 May 2018 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Cannot mark the notification as read.

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

Dear developers,

I'm getting lots of notifications along the lines of "login from unknown device". I stronlgy believe these notifications are false alarms, so I'm trying to ignore them all. Unfortunately, sometimes it's impossible to mark a notification 'read'.

Imagine: I log in to my account on ru.wiki and see the "1" marker against the web notification bell icon. Ok, I open the notification list just to see that it was yet another message "someone (probably you) etc.etc.". So I click the blue dot next to the message and the dot changes to hollow grey. I may click "mark every message read" as well - the outcome would be the same. Thus far everything is good (but annoying). The problem is that if I refresh the page or go to another wiki page, the notification would reappear again. And it wouldn't go off no matter what I do (log out, restart the browser, reboot the tablet, disable these notifications in my user settings).

Please help: what should I do to get rid of it? Igusarov (talk) 07:03, 24 August 2018 (UTC)

I am experiencing the same problem as Igusarov. 4 months ago, I got a message saying 'There has been a failed attempt to log in to your account from a new device. Please make sure your account has a strong password.' I can't get rid of it- I log in every day to see a little grey "1" next to the bell symbol at the top of the page. Geographyinitiative (talk) 09:18, 24 August 2018 (UTC)

> I can't get rid of it- I log in every day to see a little grey "1" next to the bell symbol at the top of the page.

There is actually a way (2, to be precise) to dismiss it. It's sort of a workaround. You can dismiss it by clicking on the "blue dot" found near the notification (This actually works for any notification). Also, you could dismiss the offending notification by visiting Special:Notifications in the appropriate wiki and click on the "Mark group as read" button when you're in "All" section. Kaartic ^[talk] 15:35, 25 August 2018 (UTC)

@Igusarov @Geographyinitiative This is a known issue and we're working on it in T179765. I will escalate the issue in the ticket. Thanks for reporting. NKohli (WMF) (talk) 17:51, 24 August 2018 (UTC)

I solved the problem using the blue dot method. Thanks! Geographyinitiative (talk) 15:44, 25 August 2018 (UTC)

This bug has now been fixed. If this happens to you again, please let me know. Thank you for your patience with this. NKohli (WMF) (talk) 17:14, 9 October 2018 (UTC)

Thank you for fixing the bug!

I haven't seen such notifications in quite a long while. Igusarov (talk) 20:52, 31 October 2018 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Failed login from an iPad

Never used an iPad before and the screen's sensitivity to touch messed up my several attempts until I simply gave up. I was at the BAnQ library and I am sure that the IP address is known to Mediawiki. Everything is OK, I have a strong password, and as one can see there are no problems when using a keyboard. Ineuw talk 05:28, 1 September 2018 (UTC)

I am tired of these notifications

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

Hi, recently I have started to log into my account from a different PC. After the occasion, I kept getting notifications about someone successfully entering my I’d and password. It happens every day and the notification won’t go away, even though I click on it or check it to mark as read. It stays there with gray number. It is really annoying. Can someone suggest anything?

Note: I do not want to change my password ~ Z (m) 11:00, 18 September 2018 (UTC)

Hi @HastaLaVi2. I'm sorry for the repeated notifications. This is a known bug and we are trying to solve it in T174220. I'll let you know as soon as we fix it. Thank you. NKohli (WMF) (talk) 15:20, 18 September 2018 (UTC)

same here too drew270 80.42.193.41 (talk) 15:44, 18 September 2018 (UTC)

This bug has now been fixed. If this happens to you again, please let me know. Thank you for your patience with this. NKohli (WMF) (talk) 17:13, 9 October 2018 (UTC)

Yeah, no problem here anymore. Seems that it is ok, thank you. ~ Z (m) 09:05, 10 October 2018 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

List of IPs I have logged in from

Hello, I would like on my profile a list of IPs and Geolocations I have logged into Wikipedia with. This will help greatly in knowing where all I've been and used Wikipedia from. Please get this feature live as soon as possible. Thank you! NK97 (talk) 06:10, 25 September 2018 (UTC)

Help please.

I'm sorry, but it was myself trying to log in from my mobile device. :) I guess I should remember my passwords. @Avians Avians (talk) 17:19, 26 September 2018 (UTC)

Praises

It seems everyone will gripe when something (perceived) "goes against the grain". I was hacked on a major website (the incident made national news) that involved a loss of money (that was replaced) so I would like to say thanks for the effort. I do not have to read between the lines to understand "IF" I attempted to log in and for 1000 reasons: Like missing a button with my tired eyes, forgot I changed the password, and because of a brain-fart, repeated the error, then hit the wrong button again, or logged in from an unknown browser or phone (etc...), I pretty much will know it is me that did this and can just ''ignore the message''. On the other hand; if it was not me (or my wife) then maybe it could have been a "hack attack". I am glad I get the notices (happened today) and can put up with some redundant messages, so thanks. Otr500 (talk) 23:09, 29 September 2018 (UTC)

Hi Otr500, you describe the case when someone fails to login. In that case, I fully agree with your opinion. The base of the present thread, however, is a case in which you receive such a message everytime you successfully Login, only because the server does not remember, due to any reason such as problems with cookies, that you have already logged in from the same device. However, in the past six months, this happened only once or twice to me so that I think the Underlying problem has been solved. Bjs (talk) 10:41, 14 April 2019 (UTC)

Got a successful login mail altghough I did not enable that feature?

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

I got this thing described here as a mail yesterday: Help:Login_notifications#Successful_logins

I may have logged in yesterday, that may be correct. However, I am not aware that I have ever opted-in/enabled that feature… (I also did not got it from any other wiki yet.)

Maybe this was a false-positive. I do not even know, where I could enable/disable that feature (although you possibly could document that here). And after logging in again now for posting this, I also did not get any mail. rugk (talk) 21:43, 13 April 2019 (UTC)

Hi @Rugk! This feature is enabled for all users by default as a security measure. You can disable it in your Special:Preferences under the "Notifications" tab. If you use multiple wikis, you can disable it in your Global Preferences (also under Special:Preferences).

Notifications are only sent for logins from unknown devices or IP addresses. Once the system knows about that device or IP address, it no longer sends notifications for new logins from those devices. NKohli (WMF) (talk) 02:23, 14 April 2019 (UTC)

Okay, thanks. Also explained in the entry, I did not notice that… sorry. rugk (talk) 14:48, 15 April 2019 (UTC)

Perfectly fine! :) NKohli (WMF) (talk) 17:39, 15 April 2019 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Password suggestions are a little misleading

The suggestions in Help:Login notifications#Have a strong password are not really up-to-date.

You should not really emphasize the need of special characters or so. It is easy to mathematically calculate (see Wikipedia; n=length of password; k=character set to choose from) that longer passwords are much more secure than a same-length password with more special characters.

This also aligns with new policies by the NIST. See https://nakedsecurity.sophos.com/2016/08/18/nists-new-password-rules-what-you-need-to-know/ e.g. rugk (talk) 22:02, 13 April 2019 (UTC)

Wikipedia needs to change this.

They should at least use a password reset or security questions similar to Gmail or Facebook.

E.G.

If you remember the date you join.

Identify the articles you've written.

OR

Then they give you a reset link with your E-Mail. Vampire Michella100 (talk) 11:34, 16 April 2019 (UTC)

Sorry, but no. This is exactly the wrong way and also included in the new NIST guidelines. "Knowledge-based authentication" is out as it is totally insecure. (one can just look on Facebook and see most of these things or so.)

And what articles you've written is public too, so you cannot authenticate with that…

This is really only about clarifying the paragraph there… rugk (talk) 12:49, 21 April 2019 (UTC)

Add language in the email with the title "Failed attempt to log in to Wikipedia as X"

This is not really a discussion, it is more a feature request but I posted here to guide me to the creation of the feature request if relevant.

I have a unified login. I get the email with title "Failed attempt to log in to Wikipedia as X" in multiple languages. When it comes from a language that I'm not sure recognize, I would like to have an hint from which Wikipedia the message comes. So far, I have to hover the "change password" link to see that the url is http://xx.wikipedia.org/

I suggest to improve the message saying : "Failed attempt to log in to Wikipedia (xx) as X". Jona (talk) 09:46, 18 April 2019 (UTC)

The notifications should be more informative...

...for example, the e-mail should say the IP address, the owner of the IP (based on a "whois" lookup) and the operating system that the user was on, and whether the login was successful or not. (The way that the message is worded, it sounds like the logins were successful, therefore, probably me! But this help article says that the feature is triggered for unsuccessful logins. Multiple unsuccessful logins should result in a message saying how many unsuccessful attempts there were.) 71.178.21.164 (talk) 01:00, 19 July 2019 (UTC)

I think so. 42.3.134.250 (talk) 17:45, 20 July 2019 (UTC)

I agree.-SharabSalam (talk) 09:59, 8 April 2020 (UTC)

I agree.

• The IP address / location would be helpful. I'd like to verify the login attempts are not the result of something going wrong with one of my devices.
• I'd like to understand whether the IP trying to login eventually got blocked. Or are they allowed to continue trying to brute force their way in to my account? 98.110.130.20 (talk) 14:29, 9 January 2021 (UTC)

I agree that the number of attempts would be particularly useful, to distinguish between a serious attempt to crack and someone not sure if this was their account name. Hv (talk) 16:02, 6 August 2021 (UTC)

Trying to log in to Wikidata

That's ridiculous, I am logged in Commons and he.wiki. I was able to log in even though my password is only 9 characters but not I cant do it. 79.182.37.52 (talk) 21:22, 16 September 2019 (UTC)

==Login succesful and phishing==

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

What should we do if we can't login anymore because phishing has been succesful? Thanks 2800:A4:2241:8400:501F:E115:8115:1B00 (talk) 17:54, 15 April 2020 (UTC)

You can ask about it on the Project:Support desk. Thanks. NKohli (WMF) (talk) 06:38, 19 April 2020 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Why do these messages sometimes show the IP and sometimes not?

Apparently there have been 42 attempts to log into my account from other devices in the past 24 hours. Why is it that, when someone asks for a password change, we are told the IP address they tried it from, but when they make an attempt from another device, we can't get this information? Deb (talk) 10:17, 9 January 2021 (UTC)

Porque una la inicio desde el celular y la otra desde el lap top 186.145.113.176 (talk) 05:35, 12 January 2021 (UTC)

I don't see how that's an answer. Every device has an IP address. ~ Deb (talk) 10:06, 12 January 2021 (UTC)

This has been requested at T174388. Feel free to subscribe to that task to get updates Ciencia Al Poder (talk) 12:40, 12 January 2021 (UTC)

Timing and extra information

I suspect that these notifications are shown a long time after the login attempt. Usually it's several hours, and sometimes it can be even several days. This misses the point of the notification. To be useful it's supposed to arrive after several seconds and not several hours. Sometimes I type my password incorrectly by mistake, and receive a notification after a long time. If I happen to remember that I mistyped the password, it's kind of OK, but it's not so robust. And when I don't remember if I mistyped it, I have to wonder: did I mistype it several days ago and forgot it, or was there an actual attempt to crack my account?

Other applications send such notifications instantly. Google and PayPal are obvious examples. They also show information the attempt, such as country and device brand. So it was an Android phone (which I own) from Israel (where I live), then it's less likely (though still possible) that it's a cracking attempt, and if it's a Windows device in Vietnam (this actually happened), then it may be a cracking attempt. I'm really, really not a security expert, but from the little I do know, these MediaWiki notifications are too slow and contain too little information to be really useful for security. Amir E. Aharoni {{🌎🌍🌏}} 09:19, 25 January 2021 (UTC)

Clarification needed

This says: The extension allows you to get an email when a user logs in successfully to your account from an unfamiliar device and IP.

What extension? It says it's on by default but doesn't tell me where to check. Like, are we talking Preferences>somewhere? On my home wiki, or somewhere global? It would be useful to explain this for those who like me are not as techincally oriented, thanks! Valereee (talk) 12:53, 22 February 2021 (UTC)

I agree, take me off as well Bubbabray33 (talk) 09:16, 9 March 2021 (UTC)

Minha conta foi cancelada e não sei porque

Foram detectados problemas com a sua sessão; Esta ação foi cancelada como medida de proteção contra a interceptação de sessões. Experimente usar o botão "Voltar" e atualizar a página de onde veio e tente novamente. 187.123.38.181 (talk) 13:32, 18 June 2021 (UTC)

como faço para resolver isso

Alguem pode me informar porque minha conta foi cancelada 187.123.38.181 (talk) 13:35, 18 June 2021 (UTC)

IP identification?

Didn't we use to get an email that indicated the IP address from which login attempts were made? That was a very useful thing that helped weed out LTAs. A page teaching me about passwords is of no use. Drmies (talk) 15:04, 3 August 2021 (UTC)

Yes, I have a secure password, but how can I tell it wasn't breached later?

Not a useful warning. Wikipedia should include or allow me to access enough information to assess what sort of attack it was. Let me offer three attack scenarios that I could distinguish between. (1) Trivial dictionary attack with nothing but my user name and some frequently used passwords. This would be especially harmless if it was part of a broad attack at many user names. (2) A targeted attack based on one of my actual passwords. This might be a highly personal phishing attack where some other system has been breached and that password is being tested against other systems I might be using. (3) The attack might be based on a breach of Wikipedia itself, where the password they are probing with is a partial match of my actual password. Obviously not a total breach, since that would have avoided any login failure, but perhaps something that allows them to guess highly likely passwords and the failures were incorrect confirmation attempts.

In addition to information about the nature of the login failures, something to help identify a successful breech would be helpful. Right now the only information that comes to mind would be a summary of my edits since the possible attack. I probably can't remember every edit I've made, but I almost surely could recognize weird patterns.

(Why did it MediaWiki apparently log me out? Was that a security thing? Anyway, I don't see any reason not to put my identity on this suggestive feedback (?).) Shanen (talk) 07:02, 25 December 2021 (UTC)

Regarding the footnote on password security...

... I prefer to refer people to the authority on the subject:

https://imgs.xkcd.com/comics/password_strength.png

There is no reason for 'requiring' those strange combinations of upper-case letters and numerals and symbols, just in the (mathematically incorrect) sense that they 'feel' more comfortable. Long passwords, by contrast, are far more secure, even if they are composed exclusively of dictionary words.

Information theory FTW! Gwyneth Llewelyn (talk) 14:22, 1 May 2024 (UTC)

how to check activity?

i just got a notification, i did not login into my account manually recently, but my app might have done it automatically. my password never leaked as far as i know, i use password manager and change it eventually without any consistency but might have done it in the past 3y or so, and i do not think someone else would even try to login, so i would really like to see the so proposed page with activities! any clues? Cregox (talk) 10:46, 13 August 2024 (UTC)

Meta is NOT that Meta

Seems quite confusing that the triggered login notification (as a result of logging in for this election, or perhaps as a result of failing to login to another part of Wikipedia related to the election) refers to Meta. At first I thought it was related to a fake Facebook account in my name that the "big" Meta is unable to remove or block, but now I think your email has no reference to that Meta. So there is no problem? I hope. But I still think your security email should not create confusion by saying it is from Meta. Shanen (talk) 16:23, 13 September 2024 (UTC)

Hi there. The software to tell you about login notifications uses the site's configured name ({{SITENAME}}), rather than a hand-configured message. There's a message for Meta's name, which is project-localized-name-metawiki, which displays as "Meta-Wiki" which is less likely to be confused with Meta the company, certainly.

If you think that the Meta community should rename their configured wiki name (e.g. to "Meta-Wiki", like the message), I think that's a reasonable request, but that should be a determination for that community, not the developers, so it'd be best raised at Meta:Babel. Jdforrester (WMF) (talk) 18:43, 13 September 2024 (UTC)

Thanks and sorry I didn't notice your reply earlier--but I mostly don't care about Wikipedia these years. Certainly not enough to pursue the resolution of such a minor confusion.

(Like the confusion about my logged out status. It handled it correctly anyway. I was able to log in without losing the draft.) Shanen (talk) 17:00, 26 October 2024 (UTC)

Faied login

My username and password are correct, but unfortunately I have a new PC - therefor I cannot login anymore. All the new passwords (logons) I receive, cannot give me a logon. I've tried so many times and different ways with out success ;-(

Regards Svend ~2025-38389-38 (talk) 11:05, 4 December 2025 (UTC)