The Internet is generally plagued by websites that break basic rules of security, then there's a middle tier where website try to secure passwords... but they do it incorrectly. And finally, there's websites that do security correctly and are generally secure, but may be vulnerable to attacks not directly on the password but the authentication process itself.
Please note, I'm asking strictly about the authentication part. User management, rights management, baning accounts, and so forth are not part of this question, but if you have a solution that comes with these things that's an amazing bonus, but not what I'm asking.
What boxed solutions exist that allow us to wrap authentication around pages/content, and are not vulnerable to things easily read up in OWASP: they hash passwords correctly, they send Diffie-Hellman cookies (or something like that) rather than the hash of the password as a cookie. They follow RSA PKCS specs.
What exists? This problem is getting solved every day again and again, and I honestly haven't heard of many efforts to offer one stand-alone auth solution for websites, just lots of guides out there telling you "use someone else's solution." Where are those solutions?
