   Login Theory
  I have a high level question about the best way to design a login system with usernames and passwords.I'm designing a web application for a client. When I'm done, I will hand it off to them, get paid, and hopefully never hear from them again :)My question is, how do I design it so that they could never accidentally lose all entry points into the system? I plan to have a 'forgot my password' button that will email them a new password if they forget theirs. Ok but what if they forget their password, AND dont even have the same email address anymore? I'm thinking long term here. I know its a very small possibility, but there is still a chance that it could happen. I dont want to recieve an email 5 years down the road asking for help to get back into the system. Is there a standard way to solve this problem? I could have a single administrator login, that is undeletable, that can add/delete other users from the system, and maybe reset their passwords too. But actually this doesnt solve the problem, because whoever is administrator could still forget their password and not be able to retrieve it for some reason. (As an added wrinkle, there will be 5 users of the application, but none of them can really be called the administrator, they are all basically equals... so who would I give the administrator info to?)Should I create the administrator page, but keep it for myself just in case I need it way down the road? I have to say I dont really like this idea...   
  Just what do you mean. The system is either on their physical machine, or on their rented web host. Somehow the system is installed here in first place.   ;  You're always going to run the risk of a user forgetting absolutely everything they need in order to gain access to the system.  That's just humans for ya.  The standard way to handle forgotten e-mails/passwords is to ask the user to provide several security questions and answers when they register, and the idea is that these are of a personal enough nature so that they are the only ones who would know to answer to all the questions, and that they won't be easily forgotten.  But there's still a chance they could be forgotten.  And at that point you either need someone with administrator privileges to go in and retrieve their information, or they need to create a new account.Or the third option is that you use biometric security.  The only way they won't be able to get in to the system is if they lose their fingers [grin]   ;  Give them a script they can upload to their FTP that will allow them to reset the master account's password. For additional security, make the system check if the script is still there and display a BIG RED ERROR instead of the site content telling them to delete this script.If they lose the script, charge them a fee.If they forget their FTP password....not your problem.   ;Quote:Original post by DmytryJust what do you mean. The system is either on their physical machine, or on their rented web host. Somehow the system is installed here in first place.What do you mean? I dont see what that has to do with the question.Quote:Original post by ZipsterYou're always going to run the risk of a user forgetting absolutely everything they need in order to gain access to the system.  That's just humans for ya.  The standard way to handle forgotten e-mails/passwords is to ask the user to provide several security questions and answers when they register, and the idea is that these are of a personal enough nature so that they are the only ones who would know to answer to all the questions, and that they won't be easily forgotten.  But there's still a chance they could be forgotten.  And at that point you either need someone with administrator privileges to go in and retrieve their information, or they need to create a new account.Or the third option is that you use biometric security.  The only way they won't be able to get in to the system is if they lose their fingers [grin]The problem with asking all the personal questions, is that it assumes that its still the same person. What if the administrator takes a new job and forgets to leave behind his username and password? I guess I'm probably being unrealistic here, but this is the kind of stuff I think about :)Quote:Original post by Programmer OneGive them a script they can upload to their FTP that will allow them to reset the master account's password. For additional security, make the system check if the script is still there and display a BIG RED ERROR instead of the site content telling them to delete this script.If they lose the script, charge them a fee.If they forget their FTP password....not your problem.Hmm, interesting, this is the kind of answer I was hoping for. I had something like this in mind, but I talked myself out of it, because it seems kind of hackish. Is this a standard or accepted way of doing things? Thanks folks.;Quote:Original post by AndreTheGiant[...]Hmm, interesting, this is the kind of answer I was hoping for. I had something like this in mind, but I talked myself out of it, because it seems kind of hackish. Is this a standard or accepted way of doing things?[...]The standard way is to have an IT person that has access to the server machine and can do things like edit the user database manually in order to fix things when they go really wrong. If there isn't such a person, providing a script that could be uploaded to reset passwords would probably be the next best thing. If it were me, I would probably provide a program that would prompt for the user name and generate a script to reset that user's password to a new randomly generated password that the program would output to the screen (and maybe a log file). Then, they upload the generated script to a special folder (called something like 'reset_user'), access the page using something like 'site/reset_user/extrarius.php' to reset my user. The script would reset the user's password to the password the program showed, then delete itself and any other scripts in the 'reset_user' folder (to ensure one doesn't stick around to be used by some third party later).   ;  I was also going to suggest the manual script idea, but i was too slow.If you want to milk it, you can also write the script yourself and not disclose it's existence. Then charge a fee to "fix the system" when they get locked out. Locksmiths get paid to do essentially the same thing, why shouldn't you?This is a better way to go for two reasons:1) You get paid if they get in trouble2) It's not a good idea to leave supertools in the hands of mere mortals. Where i work, i administrate a rather extensive web system with a lot of web-based admin tools. I try to give as many useful features to the non-technical staff so that i don't have to fix problems myself. However, there are a few supertools that i certainly keep to myself. If the non-technical staff even knew they existed, they would want to use them for everything all the time. That would be a much bigger disaster.   ;  Thanks all!I'm Happy to hear that my initial thoughts were not so far off.   ;Quote:Original post by AndreTheGiantQuote:Original post by DmytryJust what do you mean. The system is either on their physical machine, or on their rented web host. Somehow the system is installed here in first place.What do you mean? I dont see what that has to do with the question.everything to do. If some web stuff goes kaboom on my web server, say, i host messageboard and forget my moderator login, i'll just use exact same administrative interface to fix it which i used to install this web stuff in first place. Executing SQL query by hand or w/e to set my moderator password. If they dont know how to do that... well have them hire you again to do that.   ;Quote:Original post by DmytryQuote:Original post by AndreTheGiantQuote:Original post by DmytryJust what do you mean. The system is either on their physical machine, or on their rented web host. Somehow the system is installed here in first place.What do you mean? I dont see what that has to do with the question.everything to do. If some web stuff goes kaboom on my web server, say, i host messageboard and forget my moderator login, i'll just use exact same administrative interface to fix it which i used to install this web stuff in first place. Executing SQL query by hand or w/e to set my moderator password. If they dont know how to do that... well have them hire you again to do that.Makes sense now. Before, I was thinking in terms of the administration page, not in terms of the magic fix-it SQL script. Thanks!   