A3M - Account Authentication & Authorization Module

[eluser]Peng Kong[/eluser]
erm for a3m, coding just 1 person, me.

But I brainstorm and conduct some kind of 'user acceptance tests' with 2 to 3 other, who are developers too. They are building other systems with codeigniter and will make use of this module in future.

We basically always focus on how the system can be simplified to increase usability.

- In v0.5, you'll notice that to change your password your current password isn't needed. It isn't a mistake rather the conclusion after a long debate on why it's (or isn't) necessary. (If anyone disagrees adding the current password check should be easy. that's the good part about a3m)

- You'll also notice that "Signing Up" is nearly as easy as "Signing In". (extra captcha and email needed)

- Your regular users will either always be authenticated or "1-click" away from being authenticated

- Users have full control. They can omit anything. (what's the point of enforcing "required" fields and getting "asdasd" for all of them? If the user sees the need to give you the information he/she will. If he/she doesn't we respect that.

- Users have full control. They can change everything. (i can't change my yahoo account username! or at least i couldn't find where to change it =x and that sucks that's why I don't use my yahoo account. Twitter allows me to change my username and that's sweet)

We ask ourselves questions like:
"Do we REALLY need to collect "x information" at sign up?" (http://ui-patterns.com/pattern/LazyRegistration)
"What is the purpose of collecting the "x information"?"
"What happens if the user forgets his password? or his username?
"What if the user types the wrong email and forgets his password?"
"What happens if the user forgets his email account password?"
"What is Facebook doing in this aspect? and Twitter? and..."

We don't think in terms of right and wrong but rather the likely hood of something occuring and whether it's worth sacrificing usability to reduce potential problem.

Usability and security is a balancing game