Talk:IP Editing: Privacy Enhancement and Abuse Mitigation/Archives/2021-12

Questions about cookies and other things

Why are session cookies being suggested over persistent cookies? For cookies like centralauth_Session, they expire the moment I close the browser. Wouldn't persistent cookies that take a long time to expire be more helpful there?

Secondly, in the cookie implementation, if a person uses two different devices on the same IP address to edit, will they appear as two people or one person? Will it be possible for the software to be able to assist in associating these two pseudo-accounts to one another without using Checkuser tools?

Finally, in the encrypted IP implementation, will static IPs present themselves as the same encrypted address across an indefinite period of time? Couldn't this information be used to associate an encrypted static IP address with their unencrypted state? Also, how will IP ranges be affected by encryption? At the moment, it is generally necessary to review an IPv6 user's /64 address to get any meaningful data on their prior contributions (which is where blocks usually occur as well). The current documentation does not make this explicit, but it does seem to imply that it will mostly not be a thing. –MJL ‐Talk‐^☖ 22:10, 9 December 2021 (UTC)

MJL we are going to be using a persistent cookie. –– STei (WMF) (talk) 20:58, 14 December 2021 (UTC)

I haven't seen anyone suggest using HTTP session cookies, rather, sessions based on a cookie (similar to how the "Remember me" checkbox works on login). In a pure session-based implementation, edits from different devices that happen to use the same IP address would appear with different identifiers. The same would apply if, for example, an LTA decided to clear their cookies after every edit they made. AntiCompositeNumber (talk) 22:40, 9 December 2021 (UTC)

Couldn't device fingerprinting be used to solve the LTA example without much issue? –MJL ‐Talk‐^☖ 20:03, 12 December 2021 (UTC)

If you consider throwing out any semblance of the WMF caring about user privacy to not be an issue, sure. AntiCompositeNumber (talk) 00:59, 13 December 2021 (UTC)

Keep going!

Just leaving a message to say that I think that this is going in the right direction. Will both approaches be tested? --Gnom (talk) 23:10, 9 December 2021 (UTC)

Thanks! Our current plan is to decide on one of the approaches in January.

We'll send out some reminders at the beginning of January, to make sure more people see it and can leave feedback before January 18. /Johan (WMF) (talk) 00:14, 10 December 2021 (UTC)

@Johan (WMF): to clarify, have you relayed Suffusion's idea above (about a hybrid approach) to legal and/or the devs? I'd rather see that trialed than a one-or-the-other, tbh. ProcrastinatingReader (talk) 04:15, 31 December 2021 (UTC)

I have. We're not making any decisions right now, because we have said we'll listen to feedback until January 18 before we make any decisions at all at this and don't want to break that promise, but it's part of the feedback we'll be processing. /Johan (WMF) (talk) 00:44, 3 January 2022 (UTC)

I should note that I'm happy to see the increased activity on this page post the mass message, that was a good call. Nosebagbear (talk) 10:55, 5 January 2022 (UTC)