Viewing filter 1,247: possible keyboard-smashing in usernames - disabled

Filter parameters

Filter ID:	1,247
Description: (publicly viewable)
Filter hits:	35 hits
Conditions: (documentation)	(action == "createaccount" ) & !('override-antispoof' in user_rights) & ( lcase(accountname) rlike "(aq\|bg\|cf\|cv\|dx\|dz\|fc\|fg\|fv\|gb\|gf\|gv\|hj\|jh\|jk\|jm\|kj\|km\|mj\|mk\|qa\|qw\|qx\|qz\|sx\|sz\|vc\|vf\|vg\|wq\|wx\|xd\|xq\|xs\|xw\|xz\|zd\|zq\|zs\|zx)[^ _](aq\|bg\|cf\|cv\|dx\|dz\|fc\|fg\|fv\|gb\|gf\|gv\|hj\|jh\|jk\|jm\|kj\|km\|mj\|mk\|qa\|qw\|qx\|qz\|sx\|sz\|vc\|vf\|vg\|wq\|wx\|xd\|xq\|xs\|xw\|xz\|zd\|zq\|zs\|zx)" \| lcase(accountname) rlike "(aq\|bg\|cf\|cv\|dx\|dz\|fc\|fg\|fv\|gb\|gf\|gv\|hj\|jh\|jk\|jm\|kj\|km\|mj\|mk\|qa\|qw\|qx\|qz\|sx\|sz\|vc\|vf\|vg\|wq\|wx\|xd\|xq\|xs\|xw\|xz\|zd\|zq\|zs\|zx).(aq\|bg\|cf\|cv\|dx\|dz\|fc\|fg\|fv\|gb\|gf\|gv\|hj\|jh\|jk\|jm\|kj\|km\|mj\|mk\|qa\|qw\|qx\|qz\|sx\|sz\|vc\|vf\|vg\|wq\|wx\|xd\|xq\|xs\|xw\|xz\|zd\|zq\|zs\|zx).(aq\|bg\|cf\|cv\|dx\|dz\|fc\|fg\|fv\|gb\|gf\|gv\|hj\|jh\|jk\|jm\|kj\|km\|mj\|mk\|qa\|qw\|qx\|qz\|sx\|sz\|vc\|vf\|vg\|wq\|wx\|xd\|xq\|xs\|xw\|xz\|zd\|zq\|zs\|zx)" ) (action == "createaccount" ) & !('override-antispoof' in user_rights) & ( lcase(accountname) rlike "(aq\|bg\|cf\|cv\|dx\|dz\|fc\|fg\|fv\|gb\|gf\|gv\|hj\|jh\|jk\|jm\|kj\|km\|mj\|mk\|qa\|qw\|qx\|qz\|sx\|sz\|vc\|vf\|vg\|wq\|wx\|xd\|xq\|xs\|xw\|xz\|zd\|zq\|zs\|zx)[^ _](aq\|bg\|cf\|cv\|dx\|dz\|fc\|fg\|fv\|gb\|gf\|gv\|hj\|jh\|jk\|jm\|kj\|km\|mj\|mk\|qa\|qw\|qx\|qz\|sx\|sz\|vc\|vf\|vg\|wq\|wx\|xd\|xq\|xs\|xw\|xz\|zd\|zq\|zs\|zx)" \| lcase(accountname) rlike "(aq\|bg\|cf\|cv\|dx\|dz\|fc\|fg\|fv\|gb\|gf\|gv\|hj\|jh\|jk\|jm\|kj\|km\|mj\|mk\|qa\|qw\|qx\|qz\|sx\|sz\|vc\|vf\|vg\|wq\|wx\|xd\|xq\|xs\|xw\|xz\|zd\|zq\|zs\|zx).(aq\|bg\|cf\|cv\|dx\|dz\|fc\|fg\|fv\|gb\|gf\|gv\|hj\|jh\|jk\|jm\|kj\|km\|mj\|mk\|qa\|qw\|qx\|qz\|sx\|sz\|vc\|vf\|vg\|wq\|wx\|xd\|xq\|xs\|xw\|xz\|zd\|zq\|zs\|zx).(aq\|bg\|cf\|cv\|dx\|dz\|fc\|fg\|fv\|gb\|gf\|gv\|hj\|jh\|jk\|jm\|kj\|km\|mj\|mk\|qa\|qw\|qx\|qz\|sx\|sz\|vc\|vf\|vg\|wq\|wx\|xd\|xq\|xs\|xw\|xz\|zd\|zq\|zs\|zx)" )
Notes:	This is an experimental filter intended to detect keysmashing in newly created usernames by matching names which contain more than one usage of a plausible keysmashing bigram. "Keysmashing bigrams" are rare bigrams (in the sense of bigrams with p < 0.003 in https://www.johndcook.com/blog/2015/02/01/rare-bigrams/ , that are also keyboard adjacencies on a US keyboard. There are: 196 unusual bigrams 124 keyboard adjacency bigrams (across both QWERTY and AZERTY keyboards) of which there are 40 "bad bigrams" that are both. Hopefully this has some reasonable level of true positives combined with a low level of false negatives. Now includes adjacencies for both QWERTY and AZERTY keyboards. Long strings of digits or punctuation marks, which are also keysmashing tells, are detected by other filters. Threshold for matching: Two occurences within the same 'word', or three occurences anywhere in the entire username. Disabling: triggers on "vikashjhajhra", an entirely legitimate Indian name - A, 1 May 2023
Flags:	Hide details of this filter from public view Enable this filter Mark as deleted
Filter last modified:	11:56, 1 May 2023 by The Anome (talk \| contribs)
History:	View this filter's history
Tools:	Export this filter to another wiki {"data":{"rules":"(action == \"createaccount\" ) \u0026\r\n!('override-antispoof' in user_rights) \u0026\r\n(\r\n lcase(accountname) rlike \"(aq\|bg\|cf\|cv\|dx\|dz\|fc\|fg\|fv\|gb\|gf\|gv\|hj\|jh\|jk\|jm\|kj\|km\|mj\|mk\|qa\|qw\|qx\|qz\|sx\|sz\|vc\|vf\|vg\|wq\|wx\|xd\|xq\|xs\|xw\|xz\|zd\|zq\|zs\|zx)[^ _](aq\|bg\|cf\|cv\|dx\|dz\|fc\|fg\|fv\|gb\|gf\|gv\|hj\|jh\|jk\|jm\|kj\|km\|mj\|mk\|qa\|qw\|qx\|qz\|sx\|sz\|vc\|vf\|vg\|wq\|wx\|xd\|xq\|xs\|xw\|xz\|zd\|zq\|zs\|zx)\"\r\n\|\r\n lcase(accountname) rlike \"(aq\|bg\|cf\|cv\|dx\|dz\|fc\|fg\|fv\|gb\|gf\|gv\|hj\|jh\|jk\|jm\|kj\|km\|mj\|mk\|qa\|qw\|qx\|qz\|sx\|sz\|vc\|vf\|vg\|wq\|wx\|xd\|xq\|xs\|xw\|xz\|zd\|zq\|zs\|zx).(aq\|bg\|cf\|cv\|dx\|dz\|fc\|fg\|fv\|gb\|gf\|gv\|hj\|jh\|jk\|jm\|kj\|km\|mj\|mk\|qa\|qw\|qx\|qz\|sx\|sz\|vc\|vf\|vg\|wq\|wx\|xd\|xq\|xs\|xw\|xz\|zd\|zq\|zs\|zx).*(aq\|bg\|cf\|cv\|dx\|dz\|fc\|fg\|fv\|gb\|gf\|gv\|hj\|jh\|jk\|jm\|kj\|km\|mj\|mk\|qa\|qw\|qx\|qz\|sx\|sz\|vc\|vf\|vg\|wq\|wx\|xd\|xq\|xs\|xw\|xz\|zd\|zq\|zs\|zx)\"\r\n)","name":"possible keyboard-smashing in usernames - disabled","comments":"This is an experimental filter intended to detect keysmashing in newly created usernames by matching names which contain more than one usage of a plausible keysmashing bigram.\r\n\r\n\"Keysmashing bigrams\" are rare bigrams (in the sense of bigrams with p \u003C 0.003 in https://www.johndcook.com/blog/2015/02/01/rare-bigrams/ , that are also keyboard adjacencies on a US keyboard.\r\n\r\nThere are:\r\n\r\n196 unusual bigrams\r\n124 keyboard adjacency bigrams (across both QWERTY and AZERTY keyboards)\r\n\r\nof which there are 40 \"bad bigrams\" that are both.\r\n\r\nHopefully this has some reasonable level of true positives combined with a low level of false negatives.\r\n\r\nNow includes adjacencies for both QWERTY and AZERTY keyboards.\r\n\r\nLong strings of digits or punctuation marks, which are also keysmashing tells, are detected by other filters.\r\n\r\nThreshold for matching:\r\n\r\nTwo occurences within the same 'word', or three occurences anywhere in the entire username.\r\n\r\nDisabling: triggers on \"vikashjhajhra\", an entirely legitimate Indian name - A, 1 May 2023","group":"default","actions":[],"enabled":false,"deleted":false,"hidden":false,"global":false},"actions":[]}

Actions to take when matched

Trigger actions only if the user trips a rate limit

Number of actions to allow:

Period of time (in seconds):

Group throttle by:

user

See the documentation on mediawiki.org.

Trigger these actions after giving the user a warning

System message to use for warning:

Page name of other message:

(without "MediaWiki:" prefix)

Prevent the user from performing the action in question

System message to use for disallowing:

Page name of other message:

(without "MediaWiki:" prefix)

Revoke the user's autoconfirmed status

Tag the edit in contributions lists and page histories

Tags to apply:

(see Wikipedia:Tags for use and formatting)

(please don't rename a tag here, see link above)

(one per line, no commas, publicly visible)