User ID’s
-
Hi guys;
I’ve been using WordPress for 2 years now, and recently one of my sites was compromised by a plugin that a contractor I hired installed. It had malicious code in it that changed the password of User ID #1 (the admin) and demoted all other users to subscribers.
To me, this highlighted a flaw in the design of WordPress in that the ID’s of users is predictable, beginning with #1 for the initial admin and going onward, potentially toward customers’ accounts and data.
Would it not be prudent to use unique ID’s? For example, I had the idea to make a plugin that hooks into user creation and changes the ID to 16-char alphanumeric (a-z & 1-9) tokens – but I ran into a snag in that WP’s database by default is configured to INT. To do my idea, it needs to be configured to CHAR(16) and I don’t know how to do that safely because I’m new to web development.
The page I need help with: [log in to see the link]
-
That’s not entirely the case. You’re thinking as an experienced coder – not everyone is. For example, the script that compromised my site was hard-coded with User ID #1, no detection or anything. And indeed, I wouldn’t know how to retrieve a recursive list of all ID’s in a timely manor.
Would it stop a professional hacker? No not even close. But it’s a stumbling block. The key to security isn’t necessarily to make it IMPOSSIBLE to hack something because that in of itself is impossible – it’s to make it so difficult that it isn’t worth a pro’s time for the potential gains.
Besides, if a user submitted the function to randomly generate ID’s and there were no egregious language errors for example, would there be a specific reason to reject it? Perhaps it’s security gains are only small, but they are there nonetheless. The change wouldn’t worsen security or cause an inconvenience for users, would it?
The topic ‘User ID’s’ is closed to new replies.