Extension talk:ConfirmEdit/2014

Great extension, but .... unfortunately the 'badlogin' feature depends on the use of memcache. Most likely a good idea for larger installations, but makes this feature useless for most web-hosted installations that do not provide memcache.

This problem has been reported as a bug on Bugzilla - to me it looks to be a feature, though.

Is there a chance that anyone rewrites the code to make use of database cache as an option? (I myself just don't know enough about this.) Poensgen (talk) 11:25, 1 February 2014 (UTC) Reply

Solved. In LocalSettings.php this does the trick:

$wgMainCacheType = CACHE_DB;

Poensgen (talk) 12:35, 1 February 2014 (UTC) Reply

With the previous version of MW and this extension, there was bug that prevented any new users from adding URLs. That bug was highly effective in blocking spam, I would encourage the owners of this extension to apply the patch perhaps with the ability to disable. To the author(s) of the patch and extension, I thank you all Skunark (talk) 06:19, 15 April 2014 (UTC) Reply

I have Asirra working correctly but I am attempting to use its $wgAsirraEnlargedPositionparameter to have the pop up images displayed to the right. Have tried in LocalSettings to no avail — I don't know PHP. What is the correct language here? Thanks. 96.238.21.7 20:42, 31 July 2014 (UTC) Reply

Nemo bis believes that the extension should continue to document Asirra even though it closes down permanently as of today [1]. He thinks that this not functional module should be documented until it was removed from the code base. I do not think that this is a good idea. However, I just opened a bug for removing Asirra integration from the extension: [2].

[1] http://research.microsoft.com/en-us/um/redmond/projects/asirra/

[2] https://bugzilla.wikimedia.org/show_bug.cgi?id=71712 [[kgh]] (talk) 18:54, 6 October 2014 (UTC) Reply

Thanks for filing. Nemo 19:37, 6 October 2014 (UTC) Reply

Is it possible for a single question in QuestyCaptcha to have more than one acceptable answer? For example, is it possible to have a question such as "Fill in the blank: Blue is a ____" and allow the user to get through with both "color" and 'colour"? Schiffy (talk) 15:41, 10 October 2014 (UTC) Reply

Yes, just put the correct answers into an array:

/* ConfirmEdit */
require_once "$IP/extensions/ConfirmEdit/ConfirmEdit.php";
require_once "$IP/extensions/ConfirmEdit/QuestyCaptcha.php'; 
$wgCaptchaClass = 'QuestyCaptcha';
$arr = array (
 "A question?" => "An answer!",
 "Fill in the blank: Blue is a ..." => array(
 'colour', 'color'
 ),
 );
foreach ( $arr as $key => $value ) {
 $wgCaptchaQuestions[] = array(
 'question' => $key, 'answer' => $value
 );
}

I will add this to the docu. Cheers [[kgh]] (talk) 15:58, 10 October 2014 (UTC) Reply

Sorry to bother, but this doesn't seem to work as intended. I tried to add an external link to my main page, and the questions with one answer could be passed successfully, but the questions using array() are not letting me through. On a side note, my custom made "Webmaster" group should extend sysop, but I still had to give it skipcaptcha manually. Schiffy (talk) 18:26, 13 October 2014 (UTC) Reply

Yeah, this was quite irritating. After changing to "A question?" => 'An answer!', both worked nicely. However not if you use ". Obviously the answers have to be "quoted" identically. Sorry for this. [[kgh]] (talk) 18:54, 13 October 2014 (UTC) Reply

Well right now I'm using only ' (not ") for all the questions and all the array() bound answers), including in the foreach loop at the end ($wgCaptchaQuestions[] = array( 'question' => $key, 'answer' => $value );), and it seems to still not be working. Schiffy (talk) 19:15, 13 October 2014 (UTC) Reply

Cannot tell why it is not working for you now, but perhaps there is somebody else who sees the problem and may help. After I changed this one line in my example above everything works out fine for me. [[kgh]] (talk) 19:18, 13 October 2014 (UTC) Reply

Until someone else finds a reason I just removed the array answers. Thanks anyway. Schiffy (talk) 19:26, 13 October 2014 (UTC) Reply

Are any letter in your answer in uppercase? I just ran into the same problem and noticed in the code that QuestyCaptcha does a strtolower() on both the user input and the stored answer of there is only one answer, but if the answers are in an array it only does a strtolower() on the user input (hence if the answer has an upper case letter the check will always fail, even if the user inputs a correct answer). 72.21.231.254 21:07, 20 February 2015 (UTC) Reply

This would explain things and should be documented. Waiting for real life confirmation though. [[kgh]] (talk) 17:06, 21 February 2015 (UTC) Reply

I am trying to set this up and I have no idea what Special:version 50.70.46.20 14:52, 12 October 2014 (UTC) Reply

A page on your wiki, like Special:Version here. Nemo 06:28, 13 October 2014 (UTC) Reply

The one thing that would distract spam is to prevent them from publishing their URLs. There are several ways to accomplish this, but for new users, there needs to be an extra hook for URLs. This hook shouldn't be a captcha but an approval process with other higher ranking members. It could be as simple as a moderated page or as complex as prompting ranking members to approve randomly using the message feature. If there was a MW option, I would even be okay with blocking URLs until new users are promoted or request the URL to be added to a whitelist, we just need MW to add the URL hook to the permissions. Skunark (talk) 03:19, 21 October 2014 (UTC) Reply

Sounds like a feature request for Extension:FlaggedRevs. Nemo 05:20, 22 October 2014 (UTC) Reply

This is not working on my MW 1.23.2 installation:
http://portal.areyouahuman.com/installation/mediawiki

What can be the reason ? hollosch (talk) 17:50, 28 October 2014 (UTC) Reply

This extension currently does not support this since this required change has not been merged yet. Probably you could do a manual patch to the code as see how it goes from there. [[kgh]] (talk) 13:20, 29 October 2014 (UTC) Reply

Originally posted in Manual talk:$wgGroupPermissions

Having implemented the QuestyCaptcha part of this extension, I tried to edit my LocalSettings in such a way that autoconfirmed users can avoid the new CAPTCHA. The change I added is as follows:

$wgAutoConfirmAge = 86400;
$wgAutoConfirmCount = 10;
$wgGroupPermissions['autoconfirmed']['skipcaptcha'] = true;

This should give a user autoconfirmed status after they've made ten edits and their account is 24 hours old. The third line, however, does not seem to take effect, as the skipcaptcha right is not showing up for autoconfirmed users in Special:ListGroupRights. When I misspelled the right's name, however, it showed up for the autoconfirmed group (albeit useless, since misspelled). Spelled correctly, it's missing from ListGroupRights. Schiffy (talk) 19:24, 11 November 2014 (UTC) Reply

Are you adding these lines after the line where you include ConfirmEdit? Nemo 17:22, 12 November 2014 (UTC) Reply

That would explain it. Thanks. Schiffy (talk) 20:02, 12 November 2014 (UTC) Reply

Hi

I noticed you reverted my edits to the ConfirmEdit Extension and, of course, I don't like it so I'm here to propose other changes.

The first edit removed a Previous Edit I made and added: DO NOT use an exact copy of the dynamic questions from the link -- they've been cracked by spammers. However other dynamic questions in the style of the questions presented are highly effective.(Blue used to high light removed section). Since the new posted questions have not been cracked by spammers it's no longer a true statement. How 'bout we change it to:Do Not use an exact copy of the dynamic questions from the link; it makes it easier for spammers to crack if everyone has the same questions. However other dynamic questions in the style of the questions presented are highly effective. Or something along those lines?

Your other revert was on this add:

As an alternative to ConfirmAccount you can use the QuestyCaptcha, in following manner:

DO NOT disclose the answer in the question and ask a question that only you have the answer to. Redirect users to a page to that contains an email form to ask to join your wiki. This would require a contact page be somewhere inside your wiki. You can add an email page with this extension:ContactPage, via the Widgets Extension using the Widget:Google Form, or in several other ways.

Example Questy Confirm Account Alternative:

require_once "$IP/extensions/ConfirmEdit/QuestyCaptcha.php";
$wgCaptchaClass = 'QuestyCaptcha';
$arr = array (
'You can only join this wiki by entering the secret code below.To receive the secret code you must register via email on this page:<a href="ContactPage">Contact Page</a> ' => 'YourSecretonlytoldbyemail',
);
foreach ( $arr as $key => $value ) {
 $wgCaptchaQuestions[] = array( 'question' => $key, 'answer' => $value );
}

Or alternatively if this is a small wiki community, and you do not wish "outside" users, you could only tell the secret answer to your selective community.

Small Community Example:

require_once "$IP/extensions/ConfirmEdit/QuestyCaptcha.php";
$wgCaptchaClass = 'QuestyCaptcha';
$arr = array (
'This is a Members Only wiki. If you are a Member please enter the secret code below' => 'YourSecretcode',
);
foreach ( $arr as $key => $value ) {
 $wgCaptchaQuestions[] = array( 'question' => $key, 'answer' => $value );
}

Now I can understand that maybe that section should not be included in the page about setting up Captcha, but I still think it makes a more effective way of access control then Extension:ConfirmAccount. And since ConfirmEdit is part of the core the ways I listed above are easier for most then ConfirmAccount. What about adding it as a subpage to the extension with one line addition on the front page of the extension?

Something like this:

(sentence above ending).... highly effective.

(Add) Questy Captcha can also be used as an Alternative to the Confirm Account Extension. See: [[Subpage Name]]

Anyways just my thoughts. All the best to you. Christharp (talk) 07:22, 17 November 2014 (UTC) Reply

Hello, I moved your question here so that others can give their opinion too. From your reply it seems you didn't read my edit summary: «Doesn't matter that they've been changed, they mustn't be copied anyway. QuestyCaptcha is part of ConfirmEdit, not an alternative to it. And we don't recommend usage of ConfirmEdit as a password restriction to editing.»

I still don't understand your usage of the word "alternative" and your usage of QuestyCaptcha for unguessable answers is not prevalent across MediaWikis. Nemo 07:28, 17 November 2014 (UTC) Reply

Hi

I did read your edit summary. Points:

1. my suggested first new edit acknowledged your statement about them not being changed, but also acknowledged the truth that they no longer have been cracked.
2. the second edit about using Questy as an alternative to ConfirmAccount -- is it can be used instead of the ConfirmAccount extension. The ConfirmAccount is a totally different extension for preventing account creation at will, allowing only sysops the power to confirm an account and add a user. Since, however, that requires downlaoding a new extension, adding a new database, etc., if the same functions can be achieved by other means, especially by using an extension that's part of the core it just makes sense. Basically ConfirmEdit makes the ConfirmAccount extension obsolete.

Sorry for my lack of clarity. All the best to you. I'll check out the talk page. Christharp (talk) 14:37, 17 November 2014 (UTC) Reply

Ok. But ConfirmEdit is an extension, although it's true that ConfirmAccount is not bundled. Installing ConfirmEdit and then using it just for password protection of account creation (you don't use the password captcha for anything else, right?) might be a bad idea for performance too, if its code is called on every edit.

More importantly, having to ask a password before registration is a bad user experience in general. At that point, why couldn't you create them an account directly when asked? Or use InviteSignup to offer them the possibility?

I do see a use for your idea; but I'd like to understand better why you consider it the best solution for your case. We need its rationale to be explained well in documentation, or we'll mislead users. Nemo 07:29, 18 November 2014 (UTC) Reply

Hi

The assumption that I think the ConfirmAccount is making is that wiki is set up to only allow editing from users (that assumption could be false). That assumption is the assumption I was assuming when I wrote the section -- forgetting some wikis allow editing by anonymous people.

The code would not be called anymore then it's currently called. It would be invoked when someone went to the sign in page to join, which is the same as it is when you Use ConfirmEdit now.

Bad User experience? Anymore then a Captcha? All Captchas are a bad user experience, but without them we would be flooded with spam bots. Recently on a wiki I own the Questy questions were cracked and I was flooded with something on the order of 1000 spam accounts before I stopped it. That wiki, unfortunately, is always open to the public so the answer I gave here doesn't work.Password or Captcha before registration suck, but both answer real world problems.

The problem with InviteSignup is the assumption that the wiki admin will know everyone who wishes to join. A previously unknown person could not join the wiki.

The section I wrote was for a detailed purpose (if not expressed clearly): showing how with ConfirmEdit Questy one could do what the ConfirmAccount does. If one can use a Core extension to get rid of the need of another extension, in this case ConfirmAccount, let's make life easier by showing everyone how. Yes, it's not the purpose that ConfirmEdit was designed for, but that just shows the flexibility of the code. My method takes someone a few minutes to set up, if that, while the alternative is loading another extension, creating tables, etc., which is just a waste of time.

Once again I suggest a very detailed subpage on the method & it's purpose (replacing another extension).

All the best. Hopefully I'm providing some clarity that my earlier writing didn't. Christharp (talk) 08:15, 18 November 2014 (UTC) Reply

I would support keeping the information. Here are my main points:

1. A user of MediaWiki can do what they want or need, whether it's supported or not.
2. MediaWiki can choose whether to support a method. (If it is sensible of course)
3. It depends on a wiki's scope whether to add information, guidelines, etc. on such information.

On (1), a MediaWiki user could use it as described, to use QuestyCaptcha as an editting password. I can think of a use-case for this, such as when a wiki-admin decides it is too cumbersome to create accounts by-hand and can simply distribute the key to a group of people who is supposed to edit. Of course, as User:Christharp said, it can provide ease to the wiki-admin, as a they can do what they want, the task should be to make what is sensible, simple? It's a clever idea, one that a clever wiki-admin could figure out for themselves. Ideas such as these should be told to others who may need such a feature, but haven't thought of using it for the purpose of restricting access.

On (2), MediaWiki (and along with it, the Wikimedia Foundation) has their own incentives, and concepts such as free information, open access, the wiki way etc. However, a wiki may have many uses, perhaps it is a private wiki for company-information, or a "personal" wiki which does not concern the rest of the public and is limited to members of a group. It my opinion that some of these incentives should be encouraged but never mandatory for a MediaWiki user.

On (3), MediaWiki.org's sole task is to document the usage of MediaWiki and related software. As this is a clever use that uses the software, it depends on whether they support it (point (2)), or whether they should distribute this information. Nahiyan8 (talk) 19:51, 20 November 2014 (UTC) Reply

Will Google's new No CAPTCHA reCAPTCHA API be supported? 110.148.123.212 13:18, 5 December 2014 (UTC) Reply

Probably yes, when someone writes a patch. :) Nemo 19:43, 5 December 2014 (UTC) Reply

I've just written one. Gotta just send it in now. MisterLambda (talk) 23:38, 15 December 2014 (UTC) Reply

Great, since this seems to be a nice CAPTCHA solution. [[kgh]] (talk) 20:46, 16 December 2014 (UTC) Reply

Wait for this patch to be applied. If you must have it, apply it now, though it's in review for a reason. MisterLambda (talk) 11:35, 17 December 2014 (UTC) Reply

Cool, I just pinged someone who has a good insight into who may possibly deal with your commit, i.e. to work with you on improving it if there is the need to or to merge it for you into the repo. Excited to try it ... :) [[kgh]] (talk) 17:17, 18 December 2014 (UTC) Reply

You can look at lightweight release for new reCaptcha - Extension:ReCaptcha. Only edit & account create protection. Vedmaka★ 00:38, 19 December 2014 (UTC)

Any new info when the no captcha will be ready for official ConfirmEdit release? 85.91.136.12 15:41, 18 February 2015 (UTC) Reply

• Talk pages using deprecated source tags