If you are using NIP-46 already why not allow the user to use those credentials in other apps?
RFC on a new custodial signer I'm building. Highlights:
- Designed to be used with a single app rather than following the user around.
- Has email-based registration/reset workflows.
- Provides a signer/relay combo, reducing nip46 latency.
- Encourages users to "eject", which sends them an email with their ncryptsec, and deletes their account from the database.
The goal is to limit incentives for attackers to steal keys. The keys are only used for a single application, only keys for that application are stored, and the application eagerly deletes keys from the database. Keys are encrypted at rest.
Here's a demo video:
https://coracle-media.us-southeast-1.linodeobjects.com/burrow-demo-20241202.mov
And the source code:
Discussion
Introducing friction reduces lock-in. I want to encourage people to take custody of their keys. Not being able to sign in to the rest of nostr (especially when flotilla constantly links out to coracle) might be able to accomplish that.
> Introducing friction reduces lock-in
Ironically, because normally it's the opposite. The single-app approach widens the top of the funnel (onboarding to flotilla) while narrowing the middle of the funnel (onboarding to other nostr apps). Depending on the relative sizes of those bottlenecks, this can be a win or a loss.
I would think it's definitely a loss, no question about it.
But since you seem to think the opposite I'll give it more thought.
It looks like you're trying to not store people's keys forever, which I understand.
But even if you're not going to do it I think it could be a nice model to have a generic custodial bunker that could be used anywhere, and then after 1, 2, 3 months it would start sending emails to the person like you mentioned, and after 6 months maybe send them their keys and delete them locally.
I agree, Flotilla could gradually teach people about remote signing, i.e. using Flotilla's affiliated apps (Coracle) - "Now try to login to Coracle using this bunker-url etc". And then users would probably try to login to other apps. And then after a while you could explain that users should migrate to non-custodial signer so you could reduce risks for the user and yourself.
I wonder though whether we're shooting ourselves in the foot by trying to make the learning curve less steep... Instead of teaching users once "here is how you use Nostr - get a proper signer app and put keys there", we create these longer multi-step long-lasting flows which might create more confusion in the end. Still not clear to me where the balance is.
I think we will never know and there are millions of people out there and each will deal better with a different experience. Anyone who thinks they know what is the "best normie UX" is just delusional. The only thing we can do is try multiple approaches and do our possible best in each one of them.
“Anyone who thinks they know what is the "best normie UX" is just delusional. The only thing we can do is try multiple approaches and do our possible best in each one of them.”
oh my gosh, thank you.
I like this planned exit, but the bunker should work everywhere.