pull down to refresh
20 sats \ 8 replies \ @siggy47 24 Dec 2022 \ on: Nostr will Decentralize the web? : Pippellia's Twitter Thread nostr
The thread has valid criticism of nostr. I have already realized that if I plan on using nostr long term I will need to assume a number of identities. Right now there is no way to secure your private key without enduring the inconvenience of copy/pasting it to sign every interaction. Some people are using alby, but then you are trusting alby. I have experimented with my password manager, but it's still cumbersome and again, I need to trust my password manager. That's a scary proposition considering the Last Pass disaster.
I am still optimistic that the smart developers involved with nostr may come up with better solutions in time.
I agree... in my opinion, signing has to be done outside of the clients. I imagine something like an API on the device, where you can store your keys in a secure enclave, send in the information or message that needs to be signed through said api, and the api returns the signature. this way clients could call the device's api to sign messages, and don't need to store private keys themselves.
reply
reply
Yes, perhaps with a way of using an existing private key to avoid having to start over.
reply
Good point. That makes sense regarding the signing issue. The thread also discusses the real problem that security erodes as you use the same public key continuously.
reply
Yes, key rotation in general. Also, what happens if the Private Key DOES get compromised? There won't be a password reset button, that's for sure.
reply
I think mine has already been compromised. I don't really care, since I'm keeping no sats in my wallet and I'm just playing around with a throw away identity right now as I experiment. Things will be different when I am ready to set up a permanent presence. I'm still toying with different ideas on security.
reply
Maybe same kind of device like a hardware wallet? Or yubikey?
And of course user should always have a duplicate signing device.
It really is no different to your house or car Keys.
reply
I'm sure things will head in that direction. Of course,.when you're hodling bitcoin you need to use your wallet at most maybe inve a day. It will be impractical to access every time you like a post or respond to a dm.
Also, using the same public key over time will erode your privacy in the natural course of interacting with your followers. I guess that is the nature of social media and shouldn't be considered a problem.
reply