Security issue with Joomla 1.6

Joomla is a well-known, widely used open source CMS. According to their website, 2.7 percent of the Web is running on Joomla. Its small download size, easy installation and easy to use interface make it a top choice for a fast development of a website. If you also add the fact that it runs on a PHP/MySQL environment and that it supports a wide variety of plugins, you can see why Joomla is so appreciated.

I have recently used Joomla for a website I was developing these past few months. I must say that if you are thinking of using it for deploying a website fast and easily I would recommend it. However, it is my personal opinion that to get a great look and fell as well as to add some more complex functionalities you would need some basic CSS/HTML/PHP knowledge. For more complex functionalities you will actually need to go in the source code sometimes which entails a good if not excellent understanding of PHP. The good part is that, being open source, there is a detailed documentation as well as a large community which can help you if you run into any problems.

While I was working on the website I discovered a very interesting bug which turned out to be a very big security flaw. Note that this applies if you have more than one user with admin privileges or which can access the global configuration component in the administrator backend. 

Image based authentication

I found a very interesting paper about a very different authentication method as opposed to what is used today. The basic idea is to forget about passwords and rather select a set of images that will be presented to a user when he wants to log in together with a set of decoy images. The user selects the appropriate images and the login is done via selecting only the correct images.

They claim that this system is more useful then traditional username-password mechanisms as it is easier for a person to remember images rather then complicated text. They also claim that "password" recovery would be made easier via this method. It would have been nice to see some well-known services using such a system. However, to my knowledge, no such authentication methods are in use. 

Furthermore, such a system would render password managers obsolete, as, from what I understood in the paper, it would be very hard to store the images used for login. And to prevent the same type of problems that exists in password based systems you would have to choose different images. Maybe for just one account this would be great, but for multiple user accounts it would be hard. 

I would really like some opinions of such an authentication method. Please feel free to comment.