部分高级权限用户强制开启双因素身份验证
自2025年6月3日起，监督员与用户查核员必须启用双重认证（2FA）方可继续使用其高级权限。未来，此要求可能会扩展至其他高级权限用户。维基媒体基金会现正征询社群意见，以协助相关决策，具体问题请参见下文。
背景
A few weeks ago, as the Wikimedia Foundation in collaboration with the community functionaries, we investigated a bulk compromise of ~36,000 user accounts. One of the steps we took as part of that work was to begin technically enforcing mandatory two-factor authentication for wiki interface administrators.
We plan to continue making significant changes to increase the security of our user accounts, especially those with privileged access. Fortunately, we haven't seen any evidence of significant malicious editing or issues with content integrity from the March 2025 incident. However, a critical part of responding appropriately to any security incident is to make systemic improvements that can reduce the likelihood and impact of that kind of incident in the future.
作為這項工作的一部分，我們計劃將雙重認證的實施範圍擴大到監督員和使用者查核員，因為他們擁有訪問編輯者非公開資訊的權力。
Affected users should visit the Special:Manage Two-factor authentication page at the wiki they hold one of the above rights on (For most users, this will not be here on the meta-wiki), and configure an app that supports time-based codes (see many options listed here).
We expect to make this change on June 3, 2025, and will contact impacted users directly ahead of the change.
We believe we likely need to expand this further, including to other roles with privileged technical capabilities like bureaucrats. However, we note that expanding 2FA widely may come with further difficulties as there are limited 2FA options available to users of Wikimedia projects. We intend to expand the accessibility and security of our 2FA capabilities, such as allowing users to set up multiple authenticators, and to more fully support modern phishing-resistant methods like security keys and passkeys, in order to ease the transition to 2FA for accounts with privileged access to non-public information.
联系我们
We are posting this notice to provide some advance warning before the change is made, and as an opportunity to collect comments from the community members. We welcome input on how we can best implement 2FA enforcement actions like this, now and in the future, and what technical improvements to 2FA and related features we should pursue, to make this a smoother experience for everyone.
Please post your comments on the talk page, or if you have private feedback you can email security-help
wikimedia.org. We're especially interested in:
- What issues have you had, or seen others have, with two-factor authentication on Wikimedia projects? Please call out any software bugs, safety concerns, lack of documentation, difficulty with device compatibility, or anything else.
- Are there technical security requirements other than 2FA that we should be considering as potential requirements for maintaining privileged access on the wikis?
- What other user groups or privileges should we be focused on as we look at strengthening our security policies?
- What do we most need to be careful about as we go about this work?
- Any other comments or questions you have.
FAQ
- Who is running this consultation?
- The Wikimedia Foundation Security team supported by Movement Communications.
- How will you enforce these requirements?
- After a grace period, they will be enforced by the software. As mentioned above, this is already in place for interface administrators. Users who don't use two-factor authentication will not have access to their checkuser/oversighter permissions until they enable 2FA.
- 如果我的2FA设备遗失了会发生什么？
- When you enable 2FA, you will be presented with a series of 10 one-time recovery codes. You should safely store a copy of these codes.
- Even with 2FA enabled, you can initiate the verification process to regain access to your account by contacting ca
wikimedia.org from the confirmed email that is associated with the user account. - In order to start the process of account verification, you will need a working and confirmed email address, that is associated with your user account and which you can write emails from.
- How do I turn on 2FA for my account? I don't see the option.
- Right now, 2FA is generally only available for users with privileged access of some kind. We are investigating what would be required for us to expand 2-factor authentication availability to all Wikimedia user accounts.