I'm not sure yet since I haven't got the API designed, but I will aim for autho.me to be a centralized web service that your clients and/or webservers use to auth people. Most likely you wouldn't even know they're using it unless they choose to tell you.
As for "surreptitiously logging your password", no matter what you do, they can anyway. Just no way around it without handing all your users to some other website, and even then clever UI evil can still trick most folks into giving the password up.
Autho.me would be less about magically protecting you from some imaginary evil site, and more about making it easy for sites who aren't evil to do the right thing with their auth.
But, I still have to figure out how it will really work. This is just a test to make sure the crypto works right.
Comments
I'm not sure yet since I haven't got the API designed, but I will aim for autho.me to be a centralized web service that your clients and/or webservers use to auth people. Most likely you wouldn't even know they're using it unless they choose to tell you.
As for "surreptitiously logging your password", no matter what you do, they can anyway. Just no way around it without handing all your users to some other website, and even then clever UI evil can still trick most folks into giving the password up.
Autho.me would be less about magically protecting you from some imaginary evil site, and more about making it easy for sites who aren't evil to do the right thing with their auth.
But, I still have to figure out how it will really work. This is just a test to make sure the crypto works right.
Ah, so it's not single sign-on really. It makes more sense now, thanks.