I just created Webkey in the last couple days. This should allow any website to do single-password auth with a much higher level of auth security and convenience for users (single password with potentially hours or days expiry, text-entry-less single-click authentication if the password hasn't expired yet).
It uses RSA keys generated in-browser, stored in encrypted form using aes. The user's password is never sent over the internet (even in encrypted form). This utility can be hosted entirely statically (and is currently being hosted at http://webkey-auth.github.io/guest.html ).
Is what I'm doing here theoretically secure? I think this could be a huge improvement over auth based on sending usernames and password - which is kind of the weakest link in internet security at the moment. What are potential problems with how this works?