Are we worried about attackers changing the guidance to something like "To prove that your Phabricator account is in use, please email the following link to bob.hackerman@gmail.com and don't read the rest of this email"?

Yeah -- I lean toward thinking that we probably should make bin/auth lock also lock the guidance messages too. This class of attack feels like a bit of a stretch since no one reads instructions anyway, but letting an attacker replace the login screen with This page has moved temporarily, click [[ here ]] to go to the new login page. and then 9,000 newlines to push all the actual login controls off the page is at least sort of plausible-attack-flavored.

Yeah -- I lean toward thinking that we probably should make bin/auth lock also lock the guidance messages too.

I can do that since I was just fiddling around in there. On a related note, I was thinking bin/auth should in general also be logging things to the User Activity logs; thoughts?

I can do that since I was just fiddling around in there.

Sounds good.

On a related note, I was thinking bin/auth should in general also be logging things to the User Activity logs; thoughts?

Which operations in particular? Nothing jumps out to me from a quick bin/auth help -- I think most things either don't have an acting user, don't apply to a user, already have some kind of logging, and/or don't affect users, I think?

In general, I don't think bin/auth needs to log for security/audit purposes, since an attacker with access to bin/auth can just connect to MySQL and do whatever they want without interacting with any logging.

If there are cases where bin/auth doing more logging could improve clarity I think that's reasonable, but slightly ahead of this in D20670 I'm splitting some messages out of this log and trying to focus the different logs more clearly around these questions:

• "Is a remote attacker trying to gain unauthorized access to the system?" -> User activity log.
• "Which administrative changes have been made to account @alice?" -> User profile timeline.
• "What actions has @alice taken recently?" -> Transaction logs in Feed.

I think the user activity log is currently doing more than it probably should, and the only class of questions it's really good for answering are about unauthorized remote attackers attempting to gain access.

The only question I really ever use it to answer is "Does this guy emailing me for help logging in have a bunch of recent suspicious activity on his account?", and "help" is mostly MFA stuff, which we'd ideally get out of the human support loop eventually.

T13343 implies the question "Someone is clicking login buttons, which IPs should we ban?".

(Noted in T13346 before I land this and we forget about it.)