Hacker News Reader

JWT is an interesting standard (http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-1...) dealing with sessionless temporal auth tokens that offers some flexibility between http basic (native) or signed tokens using the same credentials. If you're not using TLS you're kind of screwed anyway, whatever the auth scheme!

I figured the salt went without saying ;)

Not if you use HMAC