Jump to content

Community Wishlist Survey 2019/Anti-harassment/Add an option to require email address and username to reset password: Difference between revisions

From Meta, a Wikimedia project coordination wiki
Content deleted Content added
not part of this
Kpgjhpjm (talk | contribs)
Support proposal
Line 27: Line 27:
* {{support}} [[User:4nn1l2|4nn1l2]] ([[User talk:4nn1l2|talk]]) 05:27, 17 November 2018 (UTC)
* {{support}} [[User:4nn1l2|4nn1l2]] ([[User talk:4nn1l2|talk]]) 05:27, 17 November 2018 (UTC)
* {{support}} [[User:Jimmyshjj|Jimmyshjj]] ([[User talk:Jimmyshjj|talk]]) 06:06, 17 November 2018 (UTC)
* {{support}} [[User:Jimmyshjj|Jimmyshjj]] ([[User talk:Jimmyshjj|talk]]) 06:06, 17 November 2018 (UTC)
* {{support}} [[User:Kpgjhpjm|Kpgjhpjm]] ([[User talk:Kpgjhpjm|talk]]) 07:37, 17 November 2018 (UTC)

Revision as of 07:37, 17 November 2018

Add an option to require email address and username to reset password

  • Problem: Trolls and LTAs have been knocking Special:PasswordReset with the intention of trolling and (currently) this cannot be prevented. Then I get password reset I did not request. While I know I have secure password (and 2FA) on both my SUL accounts and my email, it's annoying so it'd better if I can just prevent them. It sometimes gives the impression to ordinary users that their account is being compromised, which is not a good UX.
  • Who would benefit: Those who gets spammed with false password reset
  • Proposed solution: Have a OPT-IN checkbox on Preferences, turned off by default. The checkbox will require you to enter your registered email address AND your username to get a password reset. When you set this up, you know your email address, but trolls don't.
  • More comments:
  • Phabricator tickets: phab:T145952
  • Proposer: — regards, Revi 10:38, 4 November 2018 (UTC)reply

Discussion

Voting