Wikis and Security

1
Wikis and Security

• Vandals and friends are at the gate

2
Authentication and Authorization

• Authentication is making sure that we KNOW who we
  are dealing with
• Authorization is making sure that people can DO
  what they are allowed to do

3
Security is a workflow

• You have to be authenticated before your
  authorization applies
• Specific authorization can be required under
  given conditions
• or for specific activities
• Security is considered intrusive.. it is not what
  you want to do.. it is enforced

4
Wikis and Authentication

• Authentication is often not required
• User profiles are a convenience, they allow us to
  address each other
• Authentication is necessary for special roles
  like admin or steward.
• It will be necessary when the data requires
  privileged conditions e.g. Wikiversity

5
Wikis and Authentication II

• The difference between a vandal and an anonymous
  user we do not want vandals to pass our security
• When a source of vandals is identified, we want
  to have measures to prevent vandals coming in
  that way
• We want to protect our anonymous users

6
Wikis and Authorization

• Anonymous Editor Admin Bureaucrat Steward
  Developer - ..
• Wikiversity will bring us student teacher
• Teachers can be from a school
• Information of a student needs to be accessible
  by his school

7
Single login

• It will bring us one User/password for all
  Wikimedia Foundation projects
• The growth of our projects is exponentially
• The requirements on authentication and
  authorization will grow
• Authentication is something we can safely accept
  from trusted sources

8
Procedures and Security

• Procedures to do with
• recognized vandals and trolls
• open proxies
• information that is problematic
• Security is about our procedures
• You have to understand the processes
• You have to accept the work that follows from
  decisions
• It is our Wiki and therefore our security

9
Federation

• We have many partners in our battle against
  vandals
• We can use their resources to prevent vandalism
• Use the authentication of schools to ensure that
  the school can be informed who did what.

10
Surfnets A-Select

• A-Select is a great tool to do authentication and
  federation
• It allows for multiple levels
• It is Open Source (BSD)
• It is used on a very big scale (all the Dutch)
• It fulfills all the requirements of the WMF I
  know off
• It allows us to partner and improve the user
  experience of our authentication processes