Jake requests enabling access and edit access to Wikipedia via TOR

classic Classic list List threaded Threaded
45 messages Options
123
Reply | Threaded
Open this post in threaded view
|

Jake requests enabling access and edit access to Wikipedia via TOR

Thomas Gries
Hi,

during the 30C3 Congress [1] in Hamburg - where neither Wikipedia
Foundation nor MediaWiki were formally present this year (but should be
next year)-
Jacob Appelbaum [2] - core member of the TOR project - complained in one
of his numerous talks that the (edit) access to Wikipedia via TOR is not
possible.

He requested that a way should be found to enable the TOR access
including edit access to Wikipedia.

I am just the messenger of this message.

Regards,
Tom

[1] https://events.ccc.de/congress/2013/wiki/
[2] https://en.wikipedia.org/wiki/Jacob_Appelbaum

_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: Jake requests enabling access and edit access to Wikipedia via TOR

John Doe-27
Editing via tor is possible on WMF wikis if the  account / user is trusted

On Monday, December 30, 2013, Thomas Gries wrote:

> Hi,
>
> during the 30C3 Congress [1] in Hamburg - where neither Wikipedia
> Foundation nor MediaWiki were formally present this year (but should be
> next year)-
> Jacob Appelbaum [2] - core member of the TOR project - complained in one
> of his numerous talks that the (edit) access to Wikipedia via TOR is not
> possible.
>
> He requested that a way should be found to enable the TOR access
> including edit access to Wikipedia.
>
> I am just the messenger of this message.
>
> Regards,
> Tom
>
> [1] https://events.ccc.de/congress/2013/wiki/
> [2] https://en.wikipedia.org/wiki/Jacob_Appelbaum
>
> _______________________________________________
> Wikitech-l mailing list
> [hidden email] <javascript:;>
> https://lists.wikimedia.org/mailman/listinfo/wikitech-l
_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: Jake requests enabling access and edit access to Wikipedia via TOR

Thomas Gries
Am 30.12.2013 23:01, schrieb John:
> Editing via tor is possible on WMF wikis if the  account / user is trusted

Can you explain this briefly, or send me a pointer ?
This single info can be a help for him and others.
(Honestly, I do not know, what a "trusted" account/user is.)
I am on #mediawiki now


>
> On Monday, December 30, 2013, Thomas Gries wrote:
>
>> Hi,
>>
>> during the 30C3 Congress [1] in Hamburg - where neither Wikipedia
>> Foundation nor MediaWiki were formally present this year (but should be
>> next year)-
>> Jacob Appelbaum [2] - core member of the TOR project - complained in one
>> of his numerous talks that the (edit) access to Wikipedia via TOR is not
>> possible.
>>
>> He requested that a way should be found to enable the TOR access
>> including edit access to Wikipedia.
>>
>> I am just the messenger of this message.
>>
>> Regards,
>> Tom
>>
>> [1] https://events.ccc.de/congress/2013/wiki/
>> [2] https://en.wikipedia.org/wiki/Jacob_Appelbaum
>>
>> _______________________________________________
>> Wikitech-l mailing list
>> [hidden email] <javascript:;>
>> https://lists.wikimedia.org/mailman/listinfo/wikitech-l
> _______________________________________________
> Wikitech-l mailing list
> [hidden email]
> https://lists.wikimedia.org/mailman/listinfo/wikitech-l
>
> ---
> Diese E-Mail ist frei von Viren und Malware, denn der avast! Antivirus Schutz ist aktiv.
> http://www.avast.com


_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: Jake requests enabling access and edit access to Wikipedia via TOR

John Doe-27
Give me 25 minutes and ill join

On Monday, December 30, 2013, Thomas Gries wrote:

> Am 30.12.2013 23:01, schrieb John:
> > Editing via tor is possible on WMF wikis if the  account / user is
> trusted
>
> Can you explain this briefly, or send me a pointer ?
> This single info can be a help for him and others.
> (Honestly, I do not know, what a "trusted" account/user is.)
> I am on #mediawiki now
>
>
> >
> > On Monday, December 30, 2013, Thomas Gries wrote:
> >
> >> Hi,
> >>
> >> during the 30C3 Congress [1] in Hamburg - where neither Wikipedia
> >> Foundation nor MediaWiki were formally present this year (but should be
> >> next year)-
> >> Jacob Appelbaum [2] - core member of the TOR project - complained in one
> >> of his numerous talks that the (edit) access to Wikipedia via TOR is not
> >> possible.
> >>
> >> He requested that a way should be found to enable the TOR access
> >> including edit access to Wikipedia.
> >>
> >> I am just the messenger of this message.
> >>
> >> Regards,
> >> Tom
> >>
> >> [1] https://events.ccc.de/congress/2013/wiki/
> >> [2] https://en.wikipedia.org/wiki/Jacob_Appelbaum
> >>
> >> _______________________________________________
> >> Wikitech-l mailing list
> >> [hidden email] <javascript:;> <javascript:;>
> >> https://lists.wikimedia.org/mailman/listinfo/wikitech-l
> > _______________________________________________
> > Wikitech-l mailing list
> > [hidden email] <javascript:;>
> > https://lists.wikimedia.org/mailman/listinfo/wikitech-l
> >
> > ---
> > Diese E-Mail ist frei von Viren und Malware, denn der avast! Antivirus
> Schutz ist aktiv.
> > http://www.avast.com
>
>
> _______________________________________________
> Wikitech-l mailing list
> [hidden email] <javascript:;>
> https://lists.wikimedia.org/mailman/listinfo/wikitech-l
_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: Jake requests enabling access and edit access to Wikipedia via TOR

Tyler Romeo
In reply to this post by Thomas Gries
On Mon, Dec 30, 2013 at 5:03 PM, Thomas Gries <[hidden email]> wrote:

> Can you explain this briefly, or send me a pointer ?
> This single info can be a help for him and others.
> (Honestly, I do not know, what a "trusted" account/user is.)
> I am on #mediawiki now
>

There is a special permission that allows specific accounts to not be
affected by IP blocks. It is granted by application on a case-by-case
basis. You can find more information here:
https://en.wikipedia.org/wiki/Wikipedia:IP_block_exemption. I am not sure
whether similar processes exist on other wikis.

As for the original topic, this has been thoroughly discussed before, and
every time I forget what the result of the discussion is. I know for sure
that since MediaWiki is fundamentally centered around knowing users' IP
addresses in order to stop sockpuppets, simply allowing Tor users to edit
will not happen. We need a solution that allows us to know a Tor user's IP
address without actually known their IP address. If that sounds like a
difficult problem, it's because it is. One suggestion was to use a type of
token authentication, where we use RSA blinding in order to give anonymous
exemption tokens. Another suggestion was to simply abandon IP blocks, since
users can easily enough change their IP addresses anyway.

*-- *
*Tyler Romeo*
Stevens Institute of Technology, Class of 2016
Major in Computer Science
_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: Jake requests enabling access and edit access to Wikipedia via TOR

Tilman Bayer
In reply to this post by Thomas Gries
On Mon, Dec 30, 2013 at 2:03 PM, Thomas Gries <[hidden email]> wrote:
> Am 30.12.2013 23:01, schrieb John:
>> Editing via tor is possible on WMF wikis if the  account / user is trusted
>
> Can you explain this briefly, or send me a pointer ?
> This single info can be a help for him and others.
> (Honestly, I do not know, what a "trusted" account/user is.)

It seems he already knows that - he mentioned it in the 30C3 talk:
https://www.youtube.com/watch?v=SscFfzD_his#t=36m55s
(see also Roger Dingledine earlier in the same talk:
https://www.youtube.com/watch?v=SscFfzD_his#t=34m18s )

This problem has been discussed many times before, also on this list:
http://www.gossamer-threads.com/lists/wiki/wikitech/323006
There have been quite a few well-meaning but naive proposals to solve
it; I understand Jacob's remarks as a welcome call to the TOR
community to work more intensively with Wikipedians to understand the
actual issues that motivated Wikipedia's TOR block.


> I am on #mediawiki now
>
>
>>
>> On Monday, December 30, 2013, Thomas Gries wrote:
>>
>>> Hi,
>>>
>>> during the 30C3 Congress [1] in Hamburg - where neither Wikipedia
>>> Foundation nor MediaWiki were formally present this year (but should be
>>> next year)-
>>> Jacob Appelbaum [2] - core member of the TOR project - complained in one
>>> of his numerous talks that the (edit) access to Wikipedia via TOR is not
>>> possible.
>>>
>>> He requested that a way should be found to enable the TOR access
>>> including edit access to Wikipedia.
>>>
>>> I am just the messenger of this message.
>>>
>>> Regards,
>>> Tom
>>>
>>> [1] https://events.ccc.de/congress/2013/wiki/
>>> [2] https://en.wikipedia.org/wiki/Jacob_Appelbaum
>>>
>>> _______________________________________________
>>> Wikitech-l mailing list
>>> [hidden email] <javascript:;>
>>> https://lists.wikimedia.org/mailman/listinfo/wikitech-l
>> _______________________________________________
>> Wikitech-l mailing list
>> [hidden email]
>> https://lists.wikimedia.org/mailman/listinfo/wikitech-l
>>
>> ---
>> Diese E-Mail ist frei von Viren und Malware, denn der avast! Antivirus Schutz ist aktiv.
>> http://www.avast.com
>
>
> _______________________________________________
> Wikitech-l mailing list
> [hidden email]
> https://lists.wikimedia.org/mailman/listinfo/wikitech-l



--
Tilman Bayer
Senior Operations Analyst (Movement Communications)
Wikimedia Foundation
IRC (Freenode): HaeB

_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: Jake requests enabling access and edit access to Wikipedia via TOR

Thomas Gries
In reply to this post by Tyler Romeo
Thank you all, I expected such an explanation, it matches my
understanding who MediaWiki currently works.
I think, it is worth to start a  formal bugzilla about that topic, so
that it can be better tracked and commented.

Am 30.12.2013 23:10, schrieb Tyler Romeo:

> On Mon, Dec 30, 2013 at 5:03 PM, Thomas Gries <[hidden email]> wrote:
>
>> Can you explain this briefly, or send me a pointer ?
>> This single info can be a help for him and others.
>> (Honestly, I do not know, what a "trusted" account/user is.)
>> I am on #mediawiki now
>>
> There is a special permission that allows specific accounts to not be
> affected by IP blocks. It is granted by application on a case-by-case
> basis. You can find more information here:
> https://en.wikipedia.org/wiki/Wikipedia:IP_block_exemption. I am not sure
> whether similar processes exist on other wikis.
>
> As for the original topic, this has been thoroughly discussed before, and
> every time I forget what the result of the discussion is. I know for sure
> that since MediaWiki is fundamentally centered around knowing users' IP
> addresses in order to stop sockpuppets, simply allowing Tor users to edit
> will not happen. We need a solution that allows us to know a Tor user's IP
> address without actually known their IP address. If that sounds like a
> difficult problem, it's because it is. One suggestion was to use a type of
> token authentication, where we use RSA blinding in order to give anonymous
> exemption tokens. Another suggestion was to simply abandon IP blocks, since
> users can easily enough change their IP addresses anyway.
>
> *-- *
> *Tyler Romeo*
> Stevens Institute of Technology, Class of 2016
> Major in Computer Science
> _______________________________________________
> Wikitech-l mailing list
> [hidden email]
> https://lists.wikimedia.org/mailman/listinfo/wikitech-l
>
> ---
> Diese E-Mail ist frei von Viren und Malware, denn der avast! Antivirus Schutz ist aktiv.
> http://www.avast.com


_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: Jake requests enabling access and edit access to Wikipedia via TOR

Thomas Gries
In reply to this post by Tilman Bayer

> I understand Jacob's remarks as a welcome call to the TOR
community to work more intensively with Wikipedians to understand the
actual issues that motivated Wikipedia's TOR block.


This is, why we (or some core) MediaWiki developers should also attend
such congresses like the C3 regularly.


_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: Jake requests enabling access and edit access to Wikipedia via TOR

Kat Walsh-4
In reply to this post by John Doe-27
FWIW, I set IP block exempt on Jake's account a few years ago, but to my
frustration it looks like someone removed it because of inactivity.

(Editorializing a bit, I don't see much value in the removal; while it is
true that an inactive user's account could be broken into, the permission
extends to a single account, which can be blocked like any other if it
starts to act unproductively.)

-Kat


On Mon, Dec 30, 2013 at 2:01 PM, John <[hidden email]> wrote:

> Editing via tor is possible on WMF wikis if the  account / user is trusted
>
> On Monday, December 30, 2013, Thomas Gries wrote:
>
> > Hi,
> >
> > during the 30C3 Congress [1] in Hamburg - where neither Wikipedia
> > Foundation nor MediaWiki were formally present this year (but should be
> > next year)-
> > Jacob Appelbaum [2] - core member of the TOR project - complained in one
> > of his numerous talks that the (edit) access to Wikipedia via TOR is not
> > possible.
> >
> > He requested that a way should be found to enable the TOR access
> > including edit access to Wikipedia.
> >
> > I am just the messenger of this message.
> >
> > Regards,
> > Tom
> >
> > [1] https://events.ccc.de/congress/2013/wiki/
> > [2] https://en.wikipedia.org/wiki/Jacob_Appelbaum
> >
> > _______________________________________________
> > Wikitech-l mailing list
> > [hidden email] <javascript:;>
> > https://lists.wikimedia.org/mailman/listinfo/wikitech-l
> _______________________________________________
> Wikitech-l mailing list
> [hidden email]
> https://lists.wikimedia.org/mailman/listinfo/wikitech-l
>



--
Your donations keep Wikipedia free: https://donate.wikimedia.org
_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: Jake requests enabling access and edit access to Wikipedia via TOR

Tyler Romeo
In reply to this post by Thomas Gries
On Mon, Dec 30, 2013 at 5:23 PM, Thomas Gries <[hidden email]> wrote:

> This is, why we (or some core) MediaWiki developers should also attend
> such congresses like the C3 regularly.
>

Times like these living in USA is inconvenient.

*-- *
*Tyler Romeo*
Stevens Institute of Technology, Class of 2016
Major in Computer Science
_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: Jake requests enabling access and edit access to Wikipedia via TOR

Thomas Gries
I opened
https://bugzilla.wikimedia.org/show_bug.cgi?id=59146 -Enabling access
and edit access to Wikipedia via TOR
for discussions

T.


_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: Jake requests enabling access and edit access to Wikipedia via TOR

Rjd0060 -
Shouldn't the discussion *not* be happening on Bugzilla, but somewhere
where the wider community is actually present?  Perhaps Meta?


On Mon, Dec 30, 2013 at 5:41 PM, Thomas Gries <[hidden email]> wrote:

> I opened
> https://bugzilla.wikimedia.org/show_bug.cgi?id=59146 -Enabling access
> and edit access to Wikipedia via TOR
> for discussions
>
> T.
>
>
> _______________________________________________
> Wikitech-l mailing list
> [hidden email]
> https://lists.wikimedia.org/mailman/listinfo/wikitech-l




--

Ryan
User:Rjd0060
_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: Jake requests enabling access and edit access to Wikipedia via TOR

Tyler Romeo
On Mon, Dec 30, 2013 at 6:08 PM, Rjd0060 <[hidden email]> wrote:

> Shouldn't the discussion *not* be happening on Bugzilla, but somewhere
> where the wider community is actually present?  Perhaps Meta?
>

Well the issue is not whether we want Tor users editing or not. We do. The
issue is finding a software solution that makes it possible.

*-- *
*Tyler Romeo*
Stevens Institute of Technology, Class of 2016
Major in Computer Science
_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: Jake requests enabling access and edit access to Wikipedia via TOR

Risker
On 30 December 2013 18:09, Tyler Romeo <[hidden email]> wrote:

> On Mon, Dec 30, 2013 at 6:08 PM, Rjd0060 <[hidden email]> wrote:
>
> > Shouldn't the discussion *not* be happening on Bugzilla, but somewhere
> > where the wider community is actually present?  Perhaps Meta?
> >
>
> Well the issue is not whether we want Tor users editing or not. We do. The
> issue is finding a software solution that makes it possible.
>
>
I disagree fundamentally with your position here. It's technically possible
for Tor editors to edit; all we have to do is unblock Tor nodes (or for
them to disable Tor), and they can edit. It is the social and policy-based
processes that prevent Tor users from using Tor to edit.  I happen to agree
with those processes (having cleaned up major messes from unblocked Tor
nodes on enwiki), but it's not a technical problem, really.


Risker
_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: Jake requests enabling access and edit access to Wikipedia via TOR

Tyler Romeo
On Mon, Dec 30, 2013 at 6:49 PM, Risker <[hidden email]> wrote:

> I disagree fundamentally with your position here. It's technically possible
> for Tor editors to edit; all we have to do is unblock Tor nodes (or for
> them to disable Tor), and they can edit. It is the social and policy-based
> processes that prevent Tor users from using Tor to edit.  I happen to agree
> with those processes (having cleaned up major messes from unblocked Tor
> nodes on enwiki), but it's not a technical problem, really.
>

I'm confused exactly what you are disagreeing with? The consensus currently
is that Tor users should not be able to edit raw. Thus the issue at hand is
that there is currently no technical solution for allowing Tor users to
edit while still being able to block them. If you want to change the
consensus and unblock Tor users from editing, then it is indeed a
social/policy issue.

*-- *
*Tyler Romeo*
Stevens Institute of Technology, Class of 2016
Major in Computer Science
_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: Jake requests enabling access and edit access to Wikipedia via TOR

Marc-Andre
In reply to this post by Risker
On 12/30/2013 06:49 PM, Risker wrote:
> I disagree fundamentally with your position here.

I have to agree with Risker here (Oy! Twice in one year!)

The problem isn't that it is technically difficult to allow edits
through TOR, but that the vast majority of edits coming in from TOR are
abusive, and impossible to prevent or mitigate since blocking is a noop.

This is why, /as a social mechanism/, the English Wikipedia has long
established that TOR editing must be limited to the very few editors who
(a) have established a positive track record and (b) actually /need/ the
extra privacy.

Discussing this in a bugzilla will - at best - be pointless because you
need to convince the community first.

-- Marc


_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: Jake requests enabling access and edit access to Wikipedia via TOR

Risker
In reply to this post by Tyler Romeo
On 30 December 2013 18:59, Tyler Romeo <[hidden email]> wrote:

> On Mon, Dec 30, 2013 at 6:49 PM, Risker <[hidden email]> wrote:
>
> > I disagree fundamentally with your position here. It's technically
> possible
> > for Tor editors to edit; all we have to do is unblock Tor nodes (or for
> > them to disable Tor), and they can edit. It is the social and
> policy-based
> > processes that prevent Tor users from using Tor to edit.  I happen to
> agree
> > with those processes (having cleaned up major messes from unblocked Tor
> > nodes on enwiki), but it's not a technical problem, really.
> >
>
> I'm confused exactly what you are disagreeing with? The consensus currently
> is that Tor users should not be able to edit raw. Thus the issue at hand is
> that there is currently no technical solution for allowing Tor users to
> edit while still being able to block them. If you want to change the
> consensus and unblock Tor users from editing, then it is indeed a
> social/policy issue.
>
>
>
I have no desire to change the status quo.  But the solution of being able
to isolate and block individual accounts through Tor would require a change
in Tor's software and principles, not MediaWiki's.  One of its core
characteristics is to render accounts technically indistinguishable, and to
seek alternate routes when an account is prevented from editing/accessing.

Risker
_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: Jake requests enabling access and edit access to Wikipedia via TOR

Chris Steipp
On Mon, Dec 30, 2013 at 4:06 PM, Risker <[hidden email]> wrote:

> On 30 December 2013 18:59, Tyler Romeo <[hidden email]> wrote:
>
> > On Mon, Dec 30, 2013 at 6:49 PM, Risker <[hidden email]> wrote:
> >
> > > I disagree fundamentally with your position here. It's technically
> > possible
> > > for Tor editors to edit; all we have to do is unblock Tor nodes (or for
> > > them to disable Tor), and they can edit. It is the social and
> > policy-based
> > > processes that prevent Tor users from using Tor to edit.  I happen to
> > agree
> > > with those processes (having cleaned up major messes from unblocked Tor
> > > nodes on enwiki), but it's not a technical problem, really.
> > >
> >
> > I'm confused exactly what you are disagreeing with? The consensus
> currently
> > is that Tor users should not be able to edit raw. Thus the issue at hand
> is
> > that there is currently no technical solution for allowing Tor users to
> > edit while still being able to block them. If you want to change the
> > consensus and unblock Tor users from editing, then it is indeed a
> > social/policy issue.
> >
> >
> >
> I have no desire to change the status quo.  But the solution of being able
> to isolate and block individual accounts through Tor would require a change
> in Tor's software and principles, not MediaWiki's.  One of its core
> characteristics is to render accounts technically indistinguishable, and to
> seek alternate routes when an account is prevented from editing/accessing.
>
>
I think there may have been some progress on this since the last time it
was brought up, since we now have OAuth in place. It might be a way to help
bridge this gap.

I was talking with Tom Lowenthal, who is a tor developer. He was trying to
convince Tilman and I that IP's were just a form of collateral that we
implicitly hold for anonymous editors. If they edit badly, we take away the
right of that IP to edit, so they have to expend some effort to get a new
one. Tor makes that impossible for us, so one of his ideas is that we shift
to some other form of collateral-- an email address, mobile phone number,
etc. Tilman wasn't convinced, but I think I'm mostly there.

We probably don't want to do that work in MediaWiki, but with OAuth, anyone
can write an editing proxy that allows connections from Tor, ideally
negotiates some kind of collateral (proof of work, bitcoin, whatever), and
edits on behalf of the tor user. Individuals can still be held accountable
(either blocked on wiki, or you can block them in your app), or if your app
lets too many vandals in, we'll revoke your entire OAuth consumer key.

So I'm not claiming to have solved this, but if other people want to
experiment with ways to do this, I think they can do it without a change to
the current blocking policy, or getting any code deployed on the WMF
cluster.



> Risker
> _______________________________________________
> Wikitech-l mailing list
> [hidden email]
> https://lists.wikimedia.org/mailman/listinfo/wikitech-l
>
_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: Jake requests enabling access and edit access to Wikipedia via TOR

Tyler Romeo
On Mon, Dec 30, 2013 at 7:34 PM, Chris Steipp <[hidden email]> wrote:

> I was talking with Tom Lowenthal, who is a tor developer. He was trying to
> convince Tilman and I that IP's were just a form of collateral that we
> implicitly hold for anonymous editors. If they edit badly, we take away the
> right of that IP to edit, so they have to expend some effort to get a new
> one. Tor makes that impossible for us, so one of his ideas is that we shift
> to some other form of collateral-- an email address, mobile phone number,
> etc. Tilman wasn't convinced, but I think I'm mostly there.
>

This is a viable idea. Email addresses are a viable option considering they
take just as much (if not a little bit more) effort to change over as IP
addresses. We can take it even a step further and only allow email
addresses from specific domains, i.e., we can restrict providers of
so-called "throwaway emails". Probably won't accomplish too much, but in
the end it's all just a means of making it more difficult for vandals. It
will never be impossible.


> We probably don't want to do that work in MediaWiki, but with OAuth, anyone
> can write an editing proxy that allows connections from Tor, ideally
> negotiates some kind of collateral (proof of work, bitcoin, whatever), and
> edits on behalf of the tor user. Individuals can still be held accountable
> (either blocked on wiki, or you can block them in your app), or if your app
> lets too many vandals in, we'll revoke your entire OAuth consumer key.
>

It is definitely outside of core scope, but is it within OAuth scope? If
anything I think it would be some sort of separate extension that relies on
OAuth, but is not actually part of OAuth itself.

*-- *
*Tyler Romeo*
Stevens Institute of Technology, Class of 2016
Major in Computer Science
_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: Jake requests enabling access and edit access to Wikipedia via TOR

MZMcBride-2
In reply to this post by Chris Steipp
Chris Steipp wrote:
>I think there may have been some progress on this since the last time it
>was brought up, since we now have OAuth in place. It might be a way to
>help bridge this gap.
>
>I was talking with Tom Lowenthal, who is a tor developer. He was trying to
>convince Tilman and I that IP's were just a form of collateral that we
>implicitly hold for anonymous editors.

Explicitly, no? We actively record and retain the associated IP address
indefinitely if a user makes an edit without logging in. If those edits
are disruptive, there's usually a permanent public record.

The collateral idea is interesting, though it should really be "verifiable
collateral," I believe. You have to round-trip with the mobile number,
e-mail address, credit card number, etc. to ensure that it's legitimate.
Spoofed IP addresses (whether through open proxies or Tor) are generally
disallowed due to the abuse vector. Presumably in part because of the weak
verifiability of IP addresses as compared to other forms of
Identification.

And then of course there are projects like the XFF
project, which like the Tor exemption, seek to strike a balance between
liberty and anarchy. Lar used to say that you could nearly eliminate
socking if you required everyone to verify with a credit card. Which is
true, but....

Given the current rewrite of the privacy policy, it may not even be
possible to collect other forms of identification without a Board
resolution. Everyone will read the draft privacy policy's "we try to
collect as little as possible" language differently, though.

At Wikimedia's size, any potential collateral solution is proportionately
difficult to scale and secure. Wikimedia gets a lot of requests, so it
would subsequently be verifying a lot of data (we already send out X
e-mails per day and growing). In terms of security, you have to prevent
the verification system from abuse. Similar to how the donation system has
been used to make it easier to steal credit cards, mobile phone number and
other types of verification can make nefariousness easier. So you need to
implement hard and soft rate-limiting and other anti-abuse mechanisms.
Bleh.

MZMcBride



_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
123