Anyone with experience implementing Secure Remote Password?
I've been a web developer for the longest time, but I've always done authentication using conventional methods. Recently, I've learnt about Secure Remote Password (SRP), and a lot of cryptography in generally, and I'm wondering why isn't it more widely implemented.
A common refrain would be that browsers are hostile environments so there's no point in encrypting someone's password on the client-side, just use TLS and you're done. However, I think that as society starts to care more about individual rights to privacy, we as developers can and should do more.
If you are completely new to SRP, there's a good simple intro at 1Password's blog:
https://blog.1password.com/developers-how-we-use-srp-and-you-can-too/
What do fellow indie hackers think?
As the web auth standard ( https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API ) get wild acceptance i think more secure auth methods will be more widespread but the focus is now on the multi-factor auth. Standardizations and browser support i think a key for any new auth method to replace the standard user/pass.
I do think keyless auth is the way to go, but I'm thinking that adoption will take some time.