This seems like the HMAC authorisation in OAuth 1, moved to HTTP via JS and custom headers. If the comparison is right, it should be a generally secure and easy to implement auth protocol.<p>It would be great for something like this to be commonplace, but the UI definitely needs to be solid. A few questions looking at it initially:<p>- How does the browser know your private keys?<p>- How does the browser know how to send the signed header?<p>- How are nonces managed (especially over multiple devices, if the new nonce always needs to be higher than a previously used one)?<p>- Can you have more than one SIN?<p>- If so, what's the benefit of having multiple SINs vs multiple passwords?<p>On a sidenote, bitpay make some seriously kick ass tools and I love how creative they are.