Any major web service sends your password to their server in plain text. Only when the service receives the password, it derivates it and saves it in the database. What happens is a smart employee puts a backdoor at the beginning of the flow and steal your password? I worked in many large companies, and security is not what they would pretend it is. So, at the end of November, I decided to try a different authentication approach, using ED25519 Elliptic Curve. It took my one day to build the library, because I reused a library that I wrote for Secrez.
After using it for two months without having problems, I think it is time to talk about it.
If you visit https://signauth.cc you can find a brief introduction to the protocol, and you can see how it works.
The code is open-source at https://github.com/signauth, and there is also an Express-react boilerplate.
Any comment, opinion, suggestion, or critic is very welcomed.
