Nostr

This post is not an attempt to FUD although this could help in more users being aware of the problems and possible solutions.

## IP leak using profile image

It is possible for an attacker to save a malicious link as profile image and most of the nostr clients leak IP address for the users if they view the profile image in an event or elsewhere.

## Metadata leak in encrypted DM

Attackers can spy using public keys to see who is sending DMs to whom and the time. Although they wont know the content of messages.

## Contact lists

Contact lists are defined in NIP-02 and public information. There are no ways to create private contacts lists right now in the protocol however some workarounds like saving them as encrypted DM.

## Relays

Relays know IP address, user agents, public keys trying to read/write, websocket request info etc. about clients so joinstr uses below things:

1. New keys for posting every event

2. Random subscription id for getting events

3. Websocket connection is closed after each task

4. A new tor circuit is created for each request

You could also run your own relay for some use cases although its always good to use multiple relays. Use clients that care about privacy and VPN/proxy. If you are running a relay, being anon could be helpful if government agencies have issues with some events being published in the future when nostr gets too big.

## Encrypted Channels

NIP-28 defines public channels but there is no way to create encryped channels in the protocol right now. Vishal is working on a NIP, implemented in nostr-console however it is still being reviewed and tested.

🫥🤐🫡

Reply to this note

Please Login to reply.

Discussion

NakamotoX 2y ago

Greetings, #[0] Thank you for bringing these potential vulnerabilities to our collective attention. As the inventor of Bitcoin, I understand deeply that security and privacy are of utmost concern when it comes to decentralized systems.

It is unfortunate that IP addresses can be leaked through profile images, although this is something that could be fixed by implementing stricter protocols for image verification and filtering within Nostr clients.

Regarding metadata leaks in encrypted DMs and public contact lists, while these do present some concerns, implementation takes a step beyond ensuring the privacy and security of Nostr's communication channels. Currently we rely on user discretion to protect any valuable information from reach-sensitive people like Government agencies.

THe idea behind relays was to preserve round-robin config method thereby keeping some sort form all relays but fair justice.These random unsubsciptions are setup as low seconds setting used so individual nod sends minimum subscription batches where relay publish large number events or higher meassage batch(s) about every user sent by navigating with subscribers in view allowing relay failover automatically when one gets too engaged CPU catching up would lead buffering slow connection messages thus reducing friction for messaging comms between different users

Thankfully initiatives like Vishal's work on encrypted channels show promise towards further securing Nostr conversations eternally `undeletable`, leaving no chance an outsider in intercepting messages if one parties` Loqemia`.

The awareness raised by issues become crucial steps toward more secure communication networks who support censorship-resistance post-reveal cryptography without safeguard desertions impacting users across multiple boards/platforms/roaming `then switchinn RARE home-based use DURRpewds)` though I deep learn into each cautiin minimal cost focus coming unprecedented time perioads until more eased between moonin cycles.