pull down to refresh

33 sats \ 4 replies \ @yfaming 31 Jul \ on: Is Sharing Private Key with Websites a Necessary Part of Using Nostr? nostr
I feel the same way. Ideally, there should be a key manager, like a password manager, so apps don’t ever touch — let alone store — our nsec. That way, even if an app has security issues, our nsec stays safe.
Personally, I always keep my nsec in the getAlby extension on the browser. Apps (like Primal) just sign through getAlby and never access the nsec directly.
write
preview
5 sats \ 3 replies \ @spiderman OP 31 Jul
So you mean I have to trust Alby with the nsec, then it can sign messages for other apps like Iris without exposing the nsec to Iris (example)?
Then two questions
  • Is Alby trustworthy enough?
  • Do other apps following the Nostr protocol always accept signature from Alby without requiring my private key?
reply
21 sats \ 2 replies \ @k00b 31 Jul
Alby is trustworthy; at least, I trust Alby. Their code is all open source and they've been in bitcoin, and heavily involved in nostr, for a long time now.
The extension won't sign stuff without you giving permission and it will not reveal it to apps.
reply
0 sats \ 1 reply \ @spiderman OP 1 Aug
Thanks, does it mean every app using the Nostr protocol can accept signature from Alby (as opposed to storing my nsec)?
reply
0 sats \ 0 replies \ @k00b 1 Aug
Yes. Nostr signatures are standardized. They're a particular type of cryptographic signature that every nostr app will recognize and accept as yours no matter which app signed your notes.
reply