HN user
As an alternative to this checkout TozID. The premise of their authentication model is to avoid sending the password all together and use public key crypto to sign and verify requests between the client and the auth server.
I'd agree that SSO is a good option. Check out our SSO solution and ping me with any questions!
It is an SSO platform with authentication based on client side cryptography that enables end-to-end encryption for applications. It supports SAML clients like other SSO platforms.
Yes - happening here as well.
Browser crypto has come a long way. With libraries like libsodium and proper implementation I think it’s drastically better than at the time of those articles (2013 and 2011).
Source: we also write encryption libraries and have a free implementation of our browser sdk at https://share.labs.tozny.com
We made this using sodium for end to end encryption - let me know what you think!
If you're interested in reading more about it check out this blog post https://tozny.com/blog/encrypted-one-time-secret-sharing-app...
Try reading up this guide for a great intro into application level crypto... https://tozny.com/security-guides/
I agree w/ OP. Using cryptography for privacy and data control is a step in the right direction and needs some critical mass behind it for broader adoption.
Shameless plug - that is exactly what Tozny provides. An easy way to have end to end crypto with a sharing model that keeps data in control of the original writer.
Helping developers avoid the pitfalls of cryptography is the main problem we at Tozny (http://tozny.com) are trying to solve.
We found that there is so much mis-information available online it's too easy to shoot yourself in the foot with cryptography so we're trying to make tools that make strong crypto easy to implement.
Tozny | Multiple Positions | Portland, OR | ONSITE FT https://tozny.com
Tozny provides end to end encryption as a service. We work with public and private organizations to create easy to use cryptography services.
We're funded and growing rapidly. Our backend is primarily Scala and we have SDK's in many languages including node, swift, java, php, etc.
Nice! Some services don't allow non-https URLs for the webhook even for development (slack...), so might be nice to support that. Let's Encrypt provides free SSL certs if you wanted to go that route.
Assuming you are on AWS you could look into using some of their tools like Opsworks to help deal with the growing pains.
Its a temporary solution since you would just be using more servers to alleviate the root cause rather than optimizing the code. Opsworks will let you deploy additional servers easily and a contractor can do all the technical setup for you. You can queue servers based on load or time of day and it can run all of your php/database servers for you.
Hope it helps and you can use something like New Relic to help notify you of downtime or performance gaps in your application.