Accounts on Wikipedia may be compromised in a number of ways, allowing the misuse of user access levels, as well as user reputation for illegitimate purposes. It is important for users to take active steps to protect their accounts, especially those with high levels of access such as administrators. This may be done in a number of ways.
Users whose accounts are compromised may have access reduced or their accounts blocked.
In late 2016 this became a particular concern, with many accounts being compromised by a hacker group.
Infiltrators try numerous passwords, often in an automated fashion, until they happen across the correct password. Although on Wikipedia there are limitations regarding the number of login attempts over a given time period, users are still vulnerable if they use weak passwords, especially commonly used passwords. Countermeasures are a maximum of 5 logins every 5 minutes, with no more than 150 attempts allowed every 48 hours. A record is also kept of every failed login attempt.
Even strong passwords can easily become vulnerable. But they are much better than weak passwords, principally as they discourage brute-force attacks, and they make hacked websites much less vulnerable to password theft.
Password sharing for multiple uses
Passwords are highly vulnerable if re-used on different sites. If one website is hacked, and the password hash is broken or the passwords were not stored securely, all the other sites with the same password are vulnerable. The same goes for other forms of password breaches.
Similar passwords for multiple uses
If similar passwords are used on multiple websites, the hacker may be able to guess the correct password for a different use, however strong the password is. This may include a brute-force method.
Many services, including Wikipedia, allow users to reset a forgotten password by requesting a reset link be sent to their registered email address. If your email account is somehow compromised, an attacker can use it to gain control of other accounts you have. You should therefore secure your email account that receives reset links at least as well as any passwords that might need resetting. Gmail and Fastmail (and probably others) support 2FA and you should probably use it if you receive sensitive email or password resets. If 2FA is too inconvenient for everyday email, you might set up a separate 2FA-protected mailbox just for reset links and other sensitive material.
Logging in on insecure computers or devices, especially those for public use, can lead to passwords being stolen. The password is copied when it is entered to logon to a website by a malicious program called a key-logger, or a HTTP cookie allowing account access is stolen from a vulnerable computer's browser. If passwords are stored electronically it may be possible to hack them if the device or program used is insecure.
Insecure networks are generally secure from password theft, as long as HTTPS is used by the website. Wikipedia uses HTTPS for connections. But passwords transferred in an unencrypted manner are vulnerable, and rogue networks may infiltrate a computer with lax security. Cloud storage of passwords may be a vulnerability if they are not encrypted properly.
Inadvertent or unwise password sharing
This may be from following a link from a fake email, to direct you to a fake website in a so-called phishing attack. Sharing your password with someone dubious could happen in many ways. The sharing party may not necessarily be the end-user; password sharing may happen with the website provider.
Phishing is not the only risk, attackers can trick you into running malicious code in the browser, sending browser cookies to the attacker or doing something dangerous without you knowing it. To stay protected, never ever follow the instructions of the attacker; that means you shouldn't run unknown code or send any browser data like cookies.
Other password stealing
Even physically stored passwords are vulnerable to theft and copying.
Thus even strong passwords can be rendered useless unless properly secured.
This is a very effective and relatively simple measure. Now available to holders of advanced permissions, with work under way to expand availability to other users in the future. Very useful as it provides a different password each time to thwart key-loggers and other password compromises, and requires access to particular device(s).
Very useful in proving a compromised account has been returned to a legitimate owner.
Completely different strong passwords for all websites
Password sharing greatly increases vulnerability, even with strong passwords. Using similar passwords can also be a risk. Password managers are invaluable for storing collections of complex passwords instead of needing to remember them.
This is especially relevant if the user holds advanced permissions.
Periodic password changing
A compromised password may not be immediately used; periodically changing it can prevent previously compromised, but not yet exploited passwords from being used. Change it at Special:ChangeCredentials
High computer, device and network security
Computers and other devices used to logon to Wikipedia should be kept secure, especially through the use of anti-virus programs and firewalls. Only trusted software should be downloaded and installed. Computers in shared spaces should be locked before being left. Configure modem/router firewall features correctly.
High password security
Never share passwords, even with staff members. No one else should ever need to know them. Store passwords securely, and change them if there is any chance they have become compromised.
None of these techniques are foolproof, but a combination them can greatly reduce the chance of a compromised account.
Email account security
Using these measures with your email account
As described above, access to your email account may allow access to websites that use email based password resetting
If you are reasonably certain that an account may be compromised, please contact:
Stewards, who can lock the account to prevent the password/email from being changed, as well as stopping any immediate abuse. Contact at m:Steward requests/Global to request or appeal a global lock. You can also contact stewards in the following ways:
To gain emergency assistance or to ask a question, join the IRC channel #wikimedia-stewardsconnect and write !steward (your message here) in this channel to notify stewards of an emergency.
To contact a steward directly, use that steward's talk page.
Administrators, who can block the account if it is taking disruptive actions. Please note that in such cases, a global lock is preferred, since it stops disruption to all projects where the account is active and preserves the user information. They can be contacted at Wikipedia:Administrators' noticeboard.
Each group will end up contacting others during the process, either for confirmation or to perform local actions after the emergency has subsided. Advanced permissions may be removed for this portion of the case, if it is suspected that the agent(s) responsible for compromising the account are still trying to access it.
Regaining account access
A typical result of having your account compromised is having the account either blocked or locked (a lock disables login from all Wikimedia projects) to prevent further disruption. Although administrators on Wikipedia may be able to help, the WMF Trust and Safety team may also be contacted. See above for details.
No access to your account
If you are shut out from your account from a password change, a password reset may help you gain access again. But if the email has been changed this will not be possible. Logs of email changes are kept for admin accounts, which may help in establishing account ownership.
Your account is blocked
This is a likely consequence of an account being compromised. As it may not be possible to prove that an account has been returned you may have to start afresh. Having a committed identity is one of the few ways that you can prove that you are the user in question, but without this it may be very difficult to prove accounts have been returned to their rightful owner.
Your extra access may be removed
Special user groups may be temporarily removed from your account until you are back in control of it.
Your account has been globally locked
Please contact Wikimedia Foundation's Trust and Safety team by emailing trustandsafetywikimedia.org.