[siralonso]

Not only does HN not support markdown, but it breaks links you write using markdown :)

Really nice work. Question - if you generate the private keys client-side and use a password only to decrypt them for use (still client-side), wouldn't this make associating accounts across devices kinda difficult? As insecure as email/password auth is, it's pretty portable.

Looking forward to playing with bitauth!

[martindale]

Not particularly. The pattern for resolving this is already increasingly commonplace; login with your username and password, then confirm the login from one of your already authorized devices.

In fact, this even lends itself to expansion into n-factor authorization methods.