Re: [tor-talk] Wikimedia and Tor

["Derric Atzrott" <datzrott@xxxxxxxxxxxxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> Is there any mechanism available by which, e.g., known & trusted editors
> could request Tor access for specific login credentials/accounts, and Tor
> only allowed for those accounts? This would also help to address Derric's
> interest in allowing users from repressive regimes without allowing the
> vast amounts of destructive edits that have so far come from Tor. Since
> Wikimedia accounts are designed to be at least quasi-anonymous, placing a
> request for Tor access through the Wikimedia messaging system should not in
> itself reveal one's identity.
> 
> so one way to get one of these accounts would be, as many of us do, create
> a regular (non-Tor) account, perform a good number of simple,
> non-destructive edits (cleaning up already-marked items on WP pages, for
> example), and then to request a special Tor account.

There is a mechanism for this.  It is called an IP Block Exemption (IPBE),
sadly it is very hard to get because people fear its abuse so much.  I have
actually only just got it after I brought up the topic of Tor and talked
to some folks off-list about why Tor matters to me.  I've been editing
Wikipedia for over five years now.

Generally they point to the fact that you can just turn off Tor when you
want to edit Wikipedia, which misses the point, but is still the general
response.  Erik Moller, Deputy Director, at the Wikimedia Foundation,
actually tested the system for getting an IPBE once a few years ago and
it failed his test miserably.  The criteria are too high for most users,
even established ones.

> maybe if this works for established editors, a trial could be run to allow
> a limited number of new accounts through Tor to be set up, again by
> personal request, and edits allowed only through those approved accounts,
> allowing the Wikimedia software to carefully watch over these accounts for
> destructive editing and blocking them if this happens. People would
> therefore not be allowed to automatically create accounts in Tor in
> Wikimedia projects, nor to edit without logging in, but if the method
> works, a certain amount of editing over Tor could be possible.

Anyone can email in to get an account made, its getting the IPBE that is
hard.

> the overhead in approving accounts would be relatively low, and a limited
> number could be created, so that not a great deal of oversight would be
> necessary. Perhaps even a secure messaging facility could be created to
> request such accounts (if it doesn't exist already).

We have a system for handling emailed in requests of all sorts.  We make
use of OTRS to handle the sites email inboxes and have a limited number
of highly trusted volunteers that handle answering mail and making sure
requests, like account creation, get directed to the proper people.

> I would presume that a Tor-based Wikimedia account opened solely by
> messaging Wikimedia securely would be relatively hard to track down to a
> specific individual (especially if it eventually becomes possible to
> request these without first becoming a trusted editor), but I may not be
> thinking through all the possibilities.

Definitely.  And the system you describe in your email is basically the
status-quo.  Tor and all other proxies we can find are blocked unless you
have an IP Block Exemption on your account, in which case you are good to
go.  The problem is that getting an IP Block Exemption is so difficult
for a variety of social and policy reasons.

I'm hoping that if some sort of technical solution can be come up with
that would allow us to reduce the risk of abuse to the level that we have
with non-anonymous IP users editing (so blocks work in most cases, except
for that odd guy who knows how to set up a proxy themselves, or is willing
to drive to 15 different Wi-fi hotspots around town) that I will have
more luck in changing the attitudes and policy towards Tor.  The end
goal is to either have Tor completely unblocked or have the process
for getting an IPBE made significantly easier.

A few folks pointed out on the Wikimedia technical mailing list that the
problem is more of a social issue, that appears like it could have a
clever technical solution, but is really just a social problem.
Personally I believe that while it is partially a social problem, a clever
technical solution might alleviate that some and help change attitudes.

Thank you,
Derric Atzrott
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (MingW32)

iD8DBQFULEr0RHoDdZBwKDgRAr1jAKCvSdfu2TS7TnGry1HUEcUmO0l/EwCgl6HP
RRM2CfqewksCboVz/lPBq78=
=XA+w
-----END PGP SIGNATURE-----

-- 
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk