A3M - Account Authentication & Authorization Module

[eluser]gr0uch0mars[/eluser]
OK. This is a page that links from A3M wiki (author's web), and I thought you had written it. Sorry if you didn't. And thanks for the explanation of ACL, it's just I didn't remember what the letters meant.

I've just read an interesting doc about user experience on this kind of login; and referring to "username/email" I'd always choose to user email. I'm surprised you said an email can be shared by two people, because I had never thought about it (I would never share my personal email account with somebody else).

I think we should think about the "normal" user, and sharing an account it's not the usual way, I think. That's why I find this point really controversial, since I'd like to user emails, which are btw verified by the original IDP (ID provider, in this case the email provider, like Google Gmail, Yahoo...)

The document I linked above is interesting about the way users sign in, avoiding to ask for passwords twice and verify emails, if they're asked when you sign in/up with Gmail, Yahoo... This way we'd rely on trusted partners (Google, Yahoo) for those processes, making user experience (usability) easier and nicer. This of course applies to people who have a 3rd party account, not for "legitimate" users (users native from our site, registered with us), which I think email verification could be done later (let them sign in before they click the "verify account" email link, for some days).

And about the 2nd point, it's true we could be arguing the rest of the decade. I think we should distinguish between helping the user to recover his password, and users' bad practices. I've seen friends of mine who never sign out. What happens if someone takes that account, change password, email...? How could we help the legitimate user if everything has been changed by the intruder?

We should minify the pain for the user, but nowadays security cannot be relied on the user like, as you say, they show their passwords to friends and so. So we are the people who have to take care for them. Maybe thinking of another way (I'm not saying password check should be "the only way", just that we should provide security too!) Maybe session/IP check, or check trust it's the user only if he's been signed in for less than 24 hours (he's just come), but if he tries to change it 6 days after ("Remember me" checked, of course), we should check if it's really him, and not his sister trying to ***** him!!!

It's good that we share our ideas!!!