Talk:Trust and Safety Product/Temporary Accounts

Overview

Updates

Legal

FAQ

• Leave a comment in your preferred language.
• This page is used by people from a number of communities. Please avoid using acronyms from your home wiki. That will help others participate in the discussion.

Abuse filters

If an LTA from Chicago posts his rants on a small European wiki as an IP (easily switching to IPs from South America, Africa, South Asia), a good counter measure is to filter out IP edits on all his favorite topics, given that they're NOT coming from the wiki's +95% known IPs: our regular IP users can freely edit articles on stalin and rocky and...

If IPs will be discoverable only by clicking on each edit, there will be no way for me to analyze our usual IP ranges. He's smart enough to use private browsing, he can do all kinds of damage, so in this new scenario he wins. I have absolutely no idea how our abuse filters will work, given that most of them cover only IP (ab)users, who (luckily) represent the majority of our vandals. Is this being discussed? With emphasis on small(er)/nonglobal wikis? pon_or (talk) 17:21, 16 April 2024 (UTC)

Hi. Apologies for the slower reply.

If you have the rights to see IP addresses for temporary accounts and also the rights to block users, you will be able to use Special:Block to see all the IP addresses used in the last 90 days by a specific temporary account.

Furthermore, we will be adding a special page that allows you to see the contributions made by all temporary accounts on an IP address in the last 90 days.

We are also updating AbuseFilter to add a variable for the IP address used by a temporary account. This variable will be restricted to filters that can only be viewed and edited by those with the ability to see temporary account IP addresses. This means that you will be able to continue to use filters that match edits made from ranges you identify as being nearly always problematic in specific topic areas.

Hopefully this helps, and if you still have unresolved questions please do ask. WBrown (WMF) (talk) 08:45, 28 May 2024 (UTC)

@WBrown (WMF): apologies, I wasn't notified of your response. No, this won't help. I'm saying that at the moment I have the ability to say from which ~cidr/12 ranges >95% of all my (small language) wiki anon edits come from, just by analyzing IP contributions in the last 30 days (which comes to about 1500 IP edits). The LTA uses some IP hopping technology that never puts him in those 95%, but some South American or African IP ranges. So the filter does not have to be too specific when it comes to the types of words, as the LTA knows how to avoid being caught, but can be very specific about where the edits should NOT come from.

I'm not going to be able to make the list of 1500 valid IPs any more (and figure out the very broad ranges), and we'll be exposed to this extremely annoying LTA again. Some people at WMF Legal will know who I'm talking about, I believe they had some court orders against him, which did not help. pon_or (talk) 02:01, 16 July 2024 (UTC)

@Ponor, thanks for the reply. I have raised this with the team. WBrown (WMF) (talk) 07:57, 18 July 2024 (UTC)

2 FR's opened

Not sure if these are enough to be considered 'bugs' or just feature requests so went with the later:

• phab:T370679 - dealing with the output when looking at ip ranges
• phab:T370676 - dealing with the "registered users" filter (bug?)
  • Merged in to bug phab:T370695. Xaosflux (talk) 14:46, 24 July 2024 (UTC)

Xaosflux (talk) 17:22, 22 July 2024 (UTC)

Newsletter

Could someone turn the updates into an Special:Newsletter? Aaron Liu (talk) 04:17, 26 July 2024 (UTC)

Yeah, I actually was considering this lately, especially since we'll post a new update today. Great idea @Aaron! SGrabarczuk (WMF) (talk) 16:57, 26 July 2024 (UTC)

Lucky! I was actually considering it because someone added me to the graphs newsletter. Aaron Liu (talk) 03:09, 27 July 2024 (UTC)

I did, of course. :D I work with T&SP and the Charts group. The newsletter seems to be working pretty well with the Web projects, so I decided to use it for Charts, too. SGrabarczuk (WMF) (talk) 12:51, 27 July 2024 (UTC)

Alien UI

Congrats on the deployment! The banner on top of the entire page looks to be not an existing Codex design token, and I'd doubt that it fits its style guide that I have not read. I'd remove it and put the username in the normal spot instead, but if the intention was to annoy, fair play I guess, but maybe it should pick a color from the current Codex theme?

I doubt that this is an issue you'd like to fix, but when I was testing the interface in monobook, the top banner didn't appear and there was an ëdit session" portlet link. I clicked on it and got logged out. Did it actually say ëxit session"? I'm too innocent to find out by polluting the database w/ another account. Aaron Liu (talk) 03:15, 27 July 2024 (UTC)

Thanks for testing the feature, @Aaron Liu. My understanding is that the intention for the banner is not to annoy but to draw attention. I will pass the feedback along.

We will look into the issue of the banner not appearing in Monobook. And yes, that was an "exit session" link for temporary account holders. The idea being that if you are on a shared library computer or such, you may want to get rid of your temporary account to avoid incorrect edit attribution. It is one of the features we want to get more feedback about. What do you think?

(so sorry for the delayed response)

-- NKohli (WMF) (talk) 16:38, 14 August 2024 (UTC)

How will access be decided?

The lead paragraph says:

Only those who fight spam, vandalism, harassment and disinformation will have access to IP addresses.

How will that determination be made? My main activity is at en-wiki, and I don't specialize in any of those. However, I do on occasion revert and flag vandalism, place UTP templates following the multilevel warning system at en-wiki, and I sometimes initiate or follow up at en:Wikipedia:Sockpuppet investigations. I have identified a few patterns to look for, and linked up the offenders; example: en:User talk:129.94.8.198#Updated list and followed them up at SPI, but I rarely am the lead investigator. All told, this must represent < 5% of my activity, but it exists. How will you decide if someone like me (or anyone) gets this type of IP access? Mathglot (talk) 22:53, 28 July 2024 (UTC)

Does [1] answer your question? Basically, either you are an admin, checkuser, etc. or you are long-term user, and you agree with the policy. --Matěj Suchánek (talk) 06:24, 29 July 2024 (UTC)

Link to what was archived on Sunday Talk:Trust and Safety Product/Temporary Accounts/2024/June. It was archived because seven weeks went by without the Board responding to the issues raised. Please remember that the bare statement that "a temporary account will be opened for you" is illegal - the editor must be asked whether she wants a temporary account, told about the cookie and what will happen when it is implanted, and given enough information to enable her to give informed consent (or not, as the case may be). Here is a sample notice:

Page 1

I have completed the Wavelength Impact Measurement Part 1 (page 2) and agree to provide feedback upon equipment provided and its benefits via Part 2 (page 9), to help Wavelength understand and promote the effectiveness of its work. I agree to take all reasonable steps to look after any equipment, provide feedback and co-operate with any third parties Wavelength is working with. For the purpose of the General Data Protection Regulation 2018, I agree to the information given to Wavelength being kept by them and shared with Wavelength to allow Wavelength to conduct its work.

Page 2

We need your explicit consent to provide such information about you. You have the right to withdraw your consent at any time, except to the extent that action has already been processed based on your consent.

Page 9

We will store and process personal data you have provided as set out in the Wavelength Privacy Notice available at https://wavelength.org.uk/contact/privacy-cookies-wavelength-website

How will you ensure the user's informed consent and how will she be able to withdraw her consent? Having withdrawn her consent, how will you convey that information to the thousands of people using her private information? 92.29.249.130 15:10, 31 July 2024 (UTC)

Hi. We are not withholding any more information with this change. Currently IP addresses for unregistered editors are publicly stored in perpetuity. Our goal is to reduce how long this information is stored for how many users have access to it. With this change, IP address access will be limited to a small number of users who need it for patrolling purposes. This information will only be retained for 90 days.

I will assure you that our Legal team has reviewed every aspect of this project thoroughly. NKohli (WMF) (talk) 14:42, 19 August 2024 (UTC)

When this feature will be deployed on non-test wikis?

Hi, I know that the temporary account has been deployed in testwiki in July, which is a half-year delay when it was first announced in September 2023. What is the current timeline on the deployment on non-test wikis? On the announcement on September 2023, it was said that it was planned that the deployment on the first non-test wiki would be on March 2024. Due to the fact that the deployment on test wiki was delayed for half a year, is it expected that we will have this feature in September this year? 132.234.229.50 00:34, 7 August 2024 (UTC)

Hello. There has been a lot of unexpected work on this project that altered our projected timeline.

We are currently chalking out the rollout plan for this work and selecting small, low impact, pilot wikis to deploy to first. It won't be before October at least. We'll update the project page when we have more information to share. Thanks. NKohli (WMF) (talk) 14:59, 14 August 2024 (UTC)

IPv6 implementation?

@SGrabarczuk (WMF): IPv6 is 128 bits, /64 for the network and /64 for the host. For privacy reasons, most operating systems will rotate the /64 host portion of the address every once in a while. Will this each time generate a new temporary account or will these edits be grouped together? Multichill (talk) 16:52, 13 August 2024 (UTC)

@Multichill temp accounts are cookie based, so the temp account is generated on first edit, and will persist so long as the user does not clear cookies. If the user clears cookies or the account expires after 90 days, then on the next logged-out edit, the user will have a new temp account. KHarlan (WMF) (talk) 14:51, 14 August 2024 (UTC)

Please provide the exact wording of the notice which will appear when the editor whose device is cookie-free clicks the edit tab. Will she be warned of the wide range of information which will be collected about her as evidenced by this spreadsheet [2]? 92.29.240.122 19:28, 17 August 2024 (UTC)

According to the page about temporary accounts, the feature has been enabled on testwiki:, so you can test it there. If you try to edit a page, then you see MediaWiki:Autocreate-edit-warning above the textarea where you type in the wikicode. --Stefan2 (talk) 20:40, 17 August 2024 (UTC)

Special:MyPage

If you go to testwiki:Special:MyPage (or testwiki:Special:MyTalk or testwiki:Special:MyContributions) with no cookies, then you see the user page (or talk page or contributions) for your IP address. Isn't this confusing, if you get a 'real' username as soon as you edit a page?

I tried typing ~~~~, {{subst:REVISIONUSER}} and {{REVISIONUSER}} in the edit textarea and clicked on "show changes" and found that the first two show the name of a temporary account (which doesn't exist yet) while the latter shows my IP address. I find this inconsistency confusing. I didn't proceed to click on "publish changes", so I don't know what happens on the saved page. --Stefan2 (talk) 20:40, 17 August 2024 (UTC)

Thanks @Stefan2 for reporting these, I filed task T372722 about the My* pages, and task T372723 about the magic word issue. KHarlan (WMF) (talk) 05:04, 19 August 2024 (UTC)

Memorable names for temporary accounts

Moving from raw IPs to automatically assigned names will make it possible to grant memorable names, too. A name made up of two words and a year would be ideal for me as a page-history watcher.

Google Docs assigns pseudonyms to anonymous commenters in a similar way and it's great. Following Google's approach would mean usernames like "Avid banana 2024", effective at nudging new editors into selecting a name of their own, but perhaps a bit too silly for an encyclopedia.

To encourage serious editing from these accounts, Wikipedia could generate more-serious names, such as "Aristotle's chinchilla 2024" or "Harold Sowell 2024 (pseudonym)".

Reserving usernames that end in a four-digit year or "(pseudonym)" shouldn't be a problem, right? Jruderman (talk) 17:20, 20 August 2024 (UTC)

I don't like it. It could cause issues with CC-BY-SA 4.0, which states that

If You Share the Licensed Material (including in modified form), You must:

retain the following if it is supplied by the Licensor with the Licensed Material:

identification of the creator(s) of the Licensed Material and any others designated to receive attribution, in any reasonable manner requested by the Licensor (including by pseudonym if designated);

So if the contributor 'supplies' a name or pseudonym, then you have to attribute the contributor. On the other hand, if no name or pseudonym is supplied, then no attribution has to be given.

If a random pseudonym is chosen by the software, then all becomes unclear: has the contributor supplied a pseudonym or not? If the pseudonym was supplied, then it must be used for attribution, but if it wasn't supplied by the contributor (but by software which did this without the contributor's knowledge) then attributing the pseudonym could mean giving incorrect attribution, which I suspect would be a problem.

If no random pseudonym is chosen, then it seems unambiguous that no pseudonym was supplied and so we avoid the problem. --Stefan2 (talk) 17:45, 20 August 2024 (UTC)

Interesting. I hadn't considered attribution.

Does the license explicitly allow not attributing contributors who are known only by IP address?

Mid-seriousness names are probably ideal when attribution requirements are taking into account.

Perhaps having a generated pseudonym should be opt-in at the time of publishing the first edit, with a choice of three generated names and one mostly-numeric name. Jruderman (talk) 18:02, 20 August 2024 (UTC)

Temporary account is not the same as a registered account and the main purpose is to hide the IP address. If users want to choose a more serious username, they can create a registered account. SCP-2000 (talk) 18:08, 20 August 2024 (UTC)

My proposal is more for the benefit of people watching page histories and countering abuse, rather than for the benefit of everyone who edits without creating an account first. Jruderman (talk) 18:11, 20 August 2024 (UTC)

@Jruderman the idea did cross our mind when we were discussing temporary usernames.

One other challenge (besides what's mentioned above) is translation. IP addresses are currently well understood from the format itself. If we choose to go with something like "Aristotle's chinchilla 2024" it would need to be translated to be legible for other projects (since temporary accounts are global). This is quite difficult to do. So we decided to keep using numbers as they are already used for IPs. NKohli (WMF) (talk) 14:42, 21 August 2024 (UTC)

Could use automatic memorable names on some language wikis and the numeric fallbacks on others. Jruderman (talk) 17:27, 21 August 2024 (UTC)

As the username of temporary account is the same and unique across different wikis, it is difficult to use a different username on some wikis. SCP-2000 (talk) 01:26, 22 August 2024 (UTC)

Is it common for users to be active on different language wikis (not just one language wiki and the metas)? Jruderman (talk) 03:13, 22 August 2024 (UTC)

I think there are only a few newcomers who would be active on different wikis. However, as it goes against the current system work, it is unlikely to be possible from a technical perspective. SCP-2000 (talk) 04:00, 22 August 2024 (UTC)

It's probably okay for the first wiki they edit to determine their naming scheme. Jruderman (talk) 04:04, 22 August 2024 (UTC)