Holy insecure demo batman<p><a href="https://yoauth.herokuapp.com/authorize?redirect_to=http%3A%2F%2Fyoauth.herokuapp.com%2Ftest.html&username='><MARQUEE>XSS</MARQUEE><!--" rel="nofollow">https://yoauth.herokuapp.com/authorize?redirect_to=http%3A%2...</a><p>And they want me to trust them with authentication?
Yo is useless and IMO anyone that has or will put money into it no longer has any credibility as an angel/VC. Yoauth actually is comparatively useful, but unfortunately Yo does not and never will have the critical mass to make anyone want to implement it as an authentication scheme. Twitter is a distant second to Facebook in the authentication space, and Yo is no Twitter.
I'm really glad this saw the light of day. So many people were criticizing Yo for being 'useless' and all that, instead of trying to think about what to create with it.
Is it easy to "Yo" back someone if they're not in your contacts? On the android app I don't see how to do that.<p>Also, the security of this seems questionable.<p>There are other, more interesting uses of the yo API:
<a href="https://medium.com/@YoAppStatus/yo-developers-api-e7f2f0ec5c3c" rel="nofollow">https://medium.com/@YoAppStatus/yo-developers-api-e7f2f0ec5c...</a>
Why does the user need to receive a Yo? Wouldn't it be better to ask users for their handle, and then tell them to Yo a specific account in 30 seconds? If it worked like that, yoauth couldn't be used for spam, nor could you Yo someone you know in order to get their credentials if they replied.
The author of YoAuth (Bilawal) is one of the awesome student hackers helping to bring the hackathon movement to the UK. <a href="http://mlh.io/about/team#uk-team" rel="nofollow">http://mlh.io/about/team#uk-team</a>
You can see a demo here! <a href="https://www.hackerbracket.com/hacks/show/53d448e3dfb586b54fab6c44" rel="nofollow">https://www.hackerbracket.com/hacks/show/53d448e3dfb586b54fa...</a>
Plain http links? I suggest using TLS/SSL for any authentication platform. I know it's a quick hack, but you can quickly setup a secure proxy with Cloudflare.