It's an interesting concept, but I am concerned about the closed-source nature of the project. OpenID and OAuth have gotten as far as they did because they use a verifyable mechanism, all parts of which can be re-implemented and checked at will. Autho.me on the other hand is just asking for the trust of users and developers. I'm not insinuating that the code can't be trusted, but there are issues to be aware of such as very sparse documentation and the risk of investing a lot of work and goodwill in a single, private provider.
The source I have is just like the Lua that runs the website. Everything else is standards based and totally open source. As I say in the about page, I'm using:
http://srp.stanford.edu/ as the protocol, specifically SRP6a but with a SHA256 since I couldn't get a MGF1 to work in javascript. Probably change that later.
Clipperz also has a PHP SRP implementation, but it accepts any A = 0 mod N and thus allows people to log in without knowing their passwords, which is a nice feature but maybe not what you want in a secure auth scheme.
Comments
It's an interesting concept, but I am concerned about the closed-source nature of the project. OpenID and OAuth have gotten as far as they did because they use a verifyable mechanism, all parts of which can be re-implemented and checked at will. Autho.me on the other hand is just asking for the trust of users and developers. I'm not insinuating that the code can't be trusted, but there are issues to be aware of such as very sparse documentation and the risk of investing a lot of work and goodwill in a single, private provider.
The source I have is just like the Lua that runs the website. Everything else is standards based and totally open source. As I say in the about page, I'm using:
http://srp.stanford.edu/ as the protocol, specifically SRP6a but with a SHA256 since I couldn't get a MGF1 to work in javascript. Probably change that later.
http://srp.stanford.edu/download.html as the actual implementation. Yes, I'm using that C library.
http://crypto.stanford.edu/sjcl/ for the javascript crypto, also written by the same people doing SRP.
And you can read the javascript files on the site to see what it's doing.
So, it's based on entirely standards based (even has an RFC) open source protocols and uses implementations from the actual authors of said protocols.
The closed source part is just my lua Tir stuff and whatever else I make.
I've collected a few links related to JS cryptography, might be useful: http://disattention.com/13/javascript-cryptography/
There is another SRP implementation in JS+PHP: http://www.denksoft.com/wordpress/web-development/secure-aja...
We definitely need more SRP implementations, glad to see more people working on it.
Clipperz also has a PHP SRP implementation, but it accepts any A = 0 mod N and thus allows people to log in without knowing their passwords, which is a nice feature but maybe not what you want in a secure auth scheme.