Cannabis Ruderalis

thcscience_admin
"WP:PASSWORD" redirects here. For the policy on password strength, see meta:Password policy.

All registered users have to log in using a password before they can edit using their usernames. Passwords help ensure that someone does not masquerade as another editor. Editors should use a strong password to avoid being blocked for bad edits by someone who guesses or "cracks" other editors' passwords. Users may access their account's preferences to change their password.

Privileged editors

On Wikipedia, only certain users (including administrators) can perform some actions. It is especially important that these privileged editors have strong passwords. Administrators, bureaucrats, checkusers, stewards and oversighters discovered to have weak passwords, or to have had their accounts compromised by a malicious person, may have their accounts blocked and their privileges removed on grounds of site security. In certain circumstances, the revocation of privileges may be permanent. Discretion on resysopping temporarily desysopped administrators is left to the bureaucrats, provided they can determine that the administrator is back in control of the previously compromised account.

Two-factor authentication (2FA)

Main page: Help:Two-factor authentication

Wikimedia's implementation of two-factor authentication (2FA) is a way of strengthening the security of your account. If you enable two-factor authentication, every time you log in you will be asked for a one-time six-digit number in addition to your password. This number can be provided by an app on your smartphone or other authentication device (called a TOTP client). In order to login you must know your password and have your authentication device available to generate the code.

Enrolling

To set up two-factor authentication:

  • This action is currently limited to administrators, bureaucrats, oversighters, checkusers, edit filter managers, template editors and interface administrators. Other users may request 2FA at Steward requests/Global permissions on Meta.
  • First you must have or install a Time-based One-time Password Algorithm (TOTP) client. For most users, this will be a phone or tablet application. Google Authenticator is a popular example Android iOS, along with other implementations of it.
  • Next go to Special:OATH (this link is also available from your preferences).
  • Special:OATH presents you with a QR code containing the two-factor account name and two-factor secret key. This is needed to pair your client with the server.
  • Scan the QR code with, or enter the two-factor account name and key into, your TOTP client.
  • Enter a verification code from your TOTP client into the OATH screen to complete the enrollment.

Notes

For informal advice on personal security, including passwords, see Wikipedia:Personal security practices.

Users are encouraged to provide an email address in their preferences, as this enables them to reset their password via email if necessary. (Providing an email address also makes possible communications with other users via email; this can be disabled in preferences by unchecking the option "allow other users to email me".) Email alerts generated by the Wikipedia:Notifications system can also be sent to your email address, such as "failed login attempts" and "login from an unfamiliar device" notifications (these two messages are on by default, but are configurable in the notifications preferences).

See also

source: https://en.wikipedia.org/w/index.php?title=Wikipedia:User_account_security&oldid=1135194911

Leave a Reply