Buckybase 2.0 in 2010

A new release of Buckybase, the database that would be king, will hit the web sometime in 2010.

The most important features are:

• Combination of outline, wiki, and blog
• Shared and private spaces, in addition to public ones
• More interactive user interface

See you soon!

--Manuel

Buckybase 2.0 Authentication

Originally, I wanted to use OpenID 2.0 for authentication, but the spec is too heavy for me, and I don't want to incorporate large libraries at this point.

At the urging of Master Earl to DTSSTCPW, I decided to go with a simple username/password scheme for now.

Being a perfectionist, I have chosen the following route:

• All communications are encrypted via SSL. This gets rid of complex approaches to counter cookie theft.
• Session cookies contain a HMAC digest (paper) with a rotating random key on the server.
  
• Passwords on the server are stored salted using the bcrypt hash function, which can be made slower as computers get faster, to make brute-force attacks harder.

I think this approach is reasonably perfect.