Review your key management practices today. π Itβs important to stay secure, especially as we build more apps. ππ
nostr:note1qr85qsvq69es3s6403p04cnd3yaq34382ufuy25dt77pe3f5sj4qf9dpdm
Discussion
Is it yet possible to have an offline key that can revoke and reissue the online key?
No, it's not. We can't revoke keys from accessing things that they had access before. Do you have any ideas around this?
Don't use the keys for access.
Revocation seems fairly simple on nostr. Not sure what needs explaining.
The hard part of nostr delegation is the UX since keys are displayed to end users
Can you exactly explain the key management model in your mind?
Offline key signs messages about what other keys can represent it
Those other keys go in your clients
If one gets compromised, master key signs a revocation and merkle tree of pre-revocation signatures
that's NIP26 - Delegated event signing, but it's kinda deprecated:
So review our key handling practices, but it's still impossible (or deprecated) to actually have good ones...?
do you think using delegated event signing (at least the way mentioned in NIP-26) is the best practice of managing our keys?
Key delegation and revokation (or even better, rotation) are badly needed, but NIP 26 isn't it.
Some recent discussion on the topic: https://github.com/nostr-protocol/nips/pull/1452
I'm sure your perspective on the problem would be very welcome.
How does it currently work? Do nostr clients store the private key on their servers after it's submitted by the user?
Usually it's stored in the app/browser, hopefully never on the server. You can also use extensions like nos2x or alby to protect your key from the app, or you can use NIP 46 signers like nsec.app or Amber to hold your own keys and sign remotely.
Thank you for the explanation. I'm looking at the NIP-46 doc and it's really a neat solution.
Best recommended ways to do that?
I would love to hear nostr:npub1gcxzte5zlkncx26j68ez60fzkvtkm9e0vrwdcvsjakxf9mu9qewqlfnj5z & nostr:npub1jlrs53pkdfjnts29kveljul2sm0actt6n8dxrrzqcersttvcuv3qdjynqn & nostr:npub108pv4cg5ag52nq082kd5leu9ffrn2gdg6g4xdwatn73y36uzplmq9uyev6 opinions on key management practices π€
I think end users needs a good way to handle it.
Safe, accessible, easy.
Current key managers don't have these 3 at same time.
Sadly I'm one person. Otherwise it was my other project.