pull down to refresh

102 sats \ 2 replies \ @ek OP 30 Jul \ on: Not Sealed: Practical Attacks on Nostr crypto
We also show how a lack of signature checks in many clients—whether due to outright skipped verification
Afaik, Primal is guilty of this. Their client does not verify signatures.
write
preview
34 sats \ 1 reply \ @Scoresby 30 Jul
That seems bad. In my ignorance, does this mean someone could post a note claiming to be x npub without having the private keys to x npub?
reply
0 sats \ 0 replies \ @ek OP 30 Jul
No, their client only connects to their own server by default and the server crawls relays and caches notes. I assume they verify signatures there.
The problem is that Primal controls the server so they could fake notes from anyone.
reply