It's "single sign-on", but each individual website stores its own secrets, there's no centralised website, when I want to change my password I have to change it on each website.
OR
It's "single sign-on", but I have to enter my password directly into each website I log in to, and trust that they process it in javascript instead of surreptitiously logging it on their server.
I'm not sure yet since I haven't got the API designed, but I will aim for autho.me to be a centralized web service that your clients and/or webservers use to auth people. Most likely you wouldn't even know they're using it unless they choose to tell you.
As for "surreptitiously logging your password", no matter what you do, they can anyway. Just no way around it without handing all your users to some other website, and even then clever UI evil can still trick most folks into giving the password up.
Autho.me would be less about magically protecting you from some imaginary evil site, and more about making it easy for sites who aren't evil to do the right thing with their auth.
But, I still have to figure out how it will really work. This is just a test to make sure the crypto works right.
Comments
I don't understand.
It's "single sign-on", but each individual website stores its own secrets, there's no centralised website, when I want to change my password I have to change it on each website.
OR
It's "single sign-on", but I have to enter my password directly into each website I log in to, and trust that they process it in javascript instead of surreptitiously logging it on their server.
I'm not sure yet since I haven't got the API designed, but I will aim for autho.me to be a centralized web service that your clients and/or webservers use to auth people. Most likely you wouldn't even know they're using it unless they choose to tell you.
As for "surreptitiously logging your password", no matter what you do, they can anyway. Just no way around it without handing all your users to some other website, and even then clever UI evil can still trick most folks into giving the password up.
Autho.me would be less about magically protecting you from some imaginary evil site, and more about making it easy for sites who aren't evil to do the right thing with their auth.
But, I still have to figure out how it will really work. This is just a test to make sure the crypto works right.
Ah, so it's not single sign-on really. It makes more sense now, thanks.