securelogin

I see many people in this thread dread existing auth scene and ask for a better solution. Client certificates, but usable and no hardware - https://github.com/sakurity/securelogin this is the only sovereign answer to auth battles.

You just described https://github.com/sakurity/securelogin

It's not a pain, can be 1 click if you're on the same device (with log of websites you used). https://github.com/sakurity/securelogin#7-how-do-i-change-ma... Harder if on a fresh device, but totally doable for anyone

2. Not XSRF but phishing? Yes, https://github.com/sakurity/securelogin#anti-phishing-concer... - it only works for callback=ping and native apps 4. Have you tried? Because they seem to ask too hard questions like exact date your account was created. > downside of this approach is that it requires server-side state Using key-value for delivering signed token to first request? there's callback=direct that opens the link instead of pinging it, but it's a huge pain to figure out which browser you used if not the default one.

It bothers me a bit that the project has weak commit messages like this: https://github.com/sakurity/securelogin/commit/975332ae0b0e2... Literally just "1". Tells me nothing about what's happening in this change, and from the diff, it looks like quite a lot ("118 changed files with 283 additions and 179 deletions").

My email address is not my identity. https://github.com/sakurity/securelogin/issues/3

Yes, it's good one https://github.com/sakurity/securelogin/blob/master/LICENSE....

>1. how this works So if you are a developer, your best bet is "How it works?" here: https://github.com/sakurity/securelogin If you don't speak Ruby, hit me up I will dedicate all my time to help you.. and even get free audit as early adopter. FYI we conducted security audit for Auth0 (https://sakurity.com/) Actually by using auth0 you rely not on one central authority, but on two: auth0 and google/microsoft oauth. If _either_ of them is compromised, your users accounts are too. If that worries you, try SL: With SecureLogin you only rely on the local app user installs. First login friction? Not great, but is getting better, I'm giving it daily to normal users and it improves. > If this is just a communication of risks, then those are not being communicated Correct, that message is not very informative. I think it will be removed.

I found this particular passage of the protocol summary intriguing: "the server must verify two signatures of 'scope' which includes every detail of the transaction e.g. SWIFT, amount, currency, account number or Bitcoin address. Entire transaction is signed on both devices (usually desktop + mobile)." https://github.com/sakurity/securelogin The ability to subdivide authorization is one of my favorite aspects of Tarsnap, although there the delineations are both more flexible and under the control of the client instead of the server.

I'm working on the same problem, and there's a working prototype https://github.com/sakurity/truefactor The problem is bigger than that - we should stop making users type password at all. There should be an authentication module any website could use to store and retrieve credentials from. Check out Truefactor.