Of all the work I’ve ever done in web development the most intricate and difficult to actually wrap my mind around has to be user systems. There are so many terrible tutorials around that are quoted and published and taken at face value that it really surprises me when people complain about security breaches. The greatest accomplishment of my PHP career, thus far, was to do a study on how other systems had managed their user systems. I looked deep into the code behind Drupal, PHPBB and quite a few other systems, trying to figure out what makes them tick. Instead of putting time into figuring out what worked I focused on what was necessary. A more than functional knowledge of PHP is necessary if you intend on understanding a user system and why it is not for the faint of heart.
At the 50,000 foot view, a user system is something that allows the internet some personality. A login form, a username and a password combination, as well as some profile management and poof. I am me, you are you. This system allows me to log into my Drupal site and post on the blog or the wiki and update pages; it also allows me to log into my Bank of America site and check that my payments are going through smoothly. There is a lot of time and effort put into these systems to allow you to step back, focus on these two entries and receive a torrent of information. But what exactly makes a user system, and why are they so difficult to maintain?
Three words: Exploitation, security and stupidity.
I mentioned above that I use a user system on my Drupal site that allows me to login and post on the blog. Well that’s only one aspect of the Drupal site. The menu’s and page content are freely modifiable. Someone with ill content for my site could manage, given appropriate credentials, to log into my site and input what is called malicious content and really give us all a bad day. There are skilled people who devote their time to exploiting the systems (Drupal, PHPBB, MediaWiki, etc.) that you and I take for granted. Their motives range from being cocks to just being able to post some spam and see if their clients can get some “click through’s” to simply being able to say “hey, your site is not secure. You should update.”
When the first of the month comes the first thing you often want to do is check your account and make sure that the money is all there. You could, of course, have swung by your local branch and checked with a teller personally, or taken the second tiered approach and hit the ATM, but convenience is often in your court with all the added sophistication of the interwebs coming together in the last 10 years. You can now log into your bank using a username and password and gain access to your account information at your own will. And why would you worry a bit about the security of your banking information? I used to find it rather comforting to know that they had something that “had to be secure” considering they are a well renowned bank in the US of A. My naiveté disappeared when I had one of my first contract gigs and found that influential companies were handling data in profoundly retarded ways, as if to dare social engineers and those with black hats to come and get your data. Passwords in plain text, or other unencrypted mediums, like integer pin numbers; usernames available for all to see; unlimited trials without account lockouts; password replacement and open email notification.
When all of this is said and done I will be incorporating the user system into my GMS, as most sites these days require one. The system will definitely be available in its source format and freely distributable, thanks to Creative Commons.