Nostr Web Client

So you’re saying whatever first app you use to get on Nostr could/should become your signer for other apps?

Yes. Primal, Amethyst, Damus, etc. They generate your keys and sign events for you anyways. Why not add this functionality to help user experience across the ecosystem.

Eric FJ 🪬⚡️ 2mo ago

Obvs comes with some risks but this is a great idea

Derek Ross 2mo ago

more or less risks than taking your key and pasting into various nostr websites or apps? less, right? much less.

im just thinking of ways to help with user retention and we obviously have a long way to go with authentication.

Eric FJ 🪬⚡️ 2mo ago

Yeah definitely less risk than pasting all over

I’m thinking through how this would work in browser though- would they make their own extension be part of the onboarding process?

Derek Ross 2mo ago

Web apps just need to support bunker connection strings, which many do, but I'm sure we could make this better like nostr:nprofile1qqswacu3amp428kj8wtpqf77yd2upukcn2ft4aycmxm5scmh359e0ssppemhxue69uhkummn9ekx7mp0qyg8wumn8ghj7mn0wd68ytnddakj7qg4waehxw309aex2mrp0yhxgctdw4eju6t09uvt9vcv does where it's just one tap or scanning a QR code.

OceanSlim 1mo ago

The risk is entirely dependent on the client handling the keys. Could be more secure. Could be DRASTICALLY less secure... This requires trust.

whit 2mo ago

Well, why I don’t like #sexist jerks so I will never willingly use #DAMUS for anything. That’s the first issue.

syntaxerrs 2mo ago

In an Ideal World That would be amazing… but it would provide surface for political pressure or liability.

Unless there was a way for them to allow a user supplied option or adapter/extension/addon. I am pretty ignorant on this but a open source nsec bunker what I would really want anyway.

Bfgreen 2mo ago

Every nostr client (especially mobile apps) need to accept external key signing via nsec bunker or key signer. 1,000% It should be the standard. Can we also talk about key rotation...

whit 2mo ago 💬 1

I realize I’m speaking from a place of financial security others don’t have.

1. I initially signed up for #Damus but quickly @Will whatever name quickly showed himself to be a sexist.

2. Quickly removed the following year support. Because NAHHH

3. While we do have an issue retaining people … could it ** POSSIBLY ** be because this place is founded by various individuals?

4. Don’t give your money to anyone who isn’t worthy. I’d rather let it all burn 🔥 than give #ANYONE what I earned.

5. Will who created #DAMUS wouldn’t stop with the sexist rhetoric after being warned multiple times. He deserves to fail. Fax 📠

Mashi mashi 2mo ago

Lol

Freedom Tech Co. 2mo ago

For sure this makes sense

AZA_21m 2mo ago

Couldn't agree more 👏💜 Also, many of them completely ignore Zapstore and even app like Spring, which as well makes the whole experience easier/smother

daniele 2mo ago 💬 1

I don't agree, for many reasons:

- It would be extremely confusing for newcomers to use a random app to enable other apps

- A signer already requires a quite complex UI, it's not so easy to include it elsewhere keeping a good UX

- A signer should have a minimal codebase to permits an effective code review and minimize bugs that can impact on security

Derek Ross 2mo ago

Your first point is what we already do! We tell someone to download Primal, for example, and then we say oh way go to GitHub and download Amber, a random app, to sign into Primal.

We could solve all of this if Primal was the signer!

This is essentially what Damus is going to do with Notedeck! If it's good enough for nostr:nprofile1qqsr9cvzwc652r4m83d86ykplrnm9dg5gwdvzzn8ameanlvut35wy3gpz3mhxw309aex2mrp0yhx5c34x5hxxmmd9uqsuamnwvaz7tmwdaejumr0dshszythwden5te0dehhxarj9ekxzmny9u0ljp2l to rally behind, then it's probably good enough for others to consider it.

Your second, point I also don't agree with because this can easily be hidden away in advanced settings.

I do agree with your last and final point though. However, I would concede to code reviewer's approvals.

daniele 2mo ago

Amber is not a random app, it is a really specialized app,, a signer, with a specific goal. Since there will be few signers, onboarding guides will be quite similar and easy to understand. This would not happen if every app acts also as a signer.

I suspect that in your actual vision this app would not be random (Primal, Damous, ...) - this would simplify things for sure - but it would also create a dangerous centralized "super app" .

You cannot simply hide in advance setting the complexity of a signer, you need approval flows, kind preferences, easy revocation, etc.

It's not only a code review matter, that by the way cannot be effectively applied to a large pool of apps, it's a universal best practice that said that sensitive code should be isolated as much as possible to reduce bugs and the attack surface.

Finally, I think signers will become an advanced tool for "power users", newcomers will largely use (frost) bunkers created by an "my Nostr profile" app. See Nstart.me and the upcoming companion service.

Derek Ross 2mo ago

Amber is a random app to new users. You have to install it from GitHub or you have to install another random app to install Amber. Your average user will not use it. It's an advanced tool no matter how you try to spin it. If it wasn't advanced, every single Android user that exists on Nostr would already use Amber.

Sorry man, but your Nstart falls into this exact category too. It's a random website, (a website!) that a native app user has to visit to go through steps that they've never used either. Your website might have a pretty onboarding flow, but it's incredibly advanced compared to what users use today. It's why I have never once recommended it to anyone that I've onboarded.

A companion app is perhaps the way to go with Nstart, depending what this means, though I still suspect no one will use it unless it's baked into their day to day application. Otherwise it's DoA like everything else.

On-boarding and key usage needs to be roll your face across the keyboard easy or Nostr will always be for the tech savvy and the ultra early adopter.

daniele 2mo ago

I totally agree that we need to improve the onboarding, but I simply don't think that embedding a signer everywhere is the solution.

The most likely scenario is that the user will log in using any recommended client, then as soon as they want to explore the ecosystem, they will discover that pasting the nsec everywhere is not sane and will therefore download a “profile manager” (or signer) to manage the different accesses.

Of course, they can also start with the latter app, provided they are properly informed from the very beginning.

PS: for "companion service" I mean something that will allow existentnpubs to create FROST bunkers.

PSS: a website, apart from having a larger attack surface, is more immediately accessible, on every platform, and can be more easily assessed in terms of reliability (through domain).

Derek Ross 2mo ago

using a third party application or website to do this is just not something your average person is going to do.

the other stuff of nostr, things that are vastly websites, are barely used today. most people don't want to use extensions and signers. and many don't want to leave their current app.

for example, people stopped using nostr nests because i required them to sign in to nostr. it was too difficult to use an extension or a bunker. many people just do not use them or understand them. that blew my mind. and that's experienced users!

explaining this to new users when onboarding them is even worse! telling them about the other stuff and how they shouldn't enter their nsec, that they need a third party application, it's literally a death sentence. i see it in their faces. they think it's cool, but in practice, it's too new and too difficult.

referring to a dedicated application as a profile manager application is a nice touch. it should manage the user's profile and the user's profile permissions to sign events. and from there the application should recommmend other applications to use.

but im telling you, telling someone to go download a profile manager to continue exploring the ecosystem is part of the issue we have today with extensions and bunkers.

Bfgreen 2mo ago

This is a real challenge. And there will always be ‘levels’ of users based on experience, comfort, and security. I would love to see a simple hardware token, such as Yubikey support nsec via nfc. The masses are just now getting used to 2FA and a HW dongle would be user friendly.

daniele 2mo ago

People have gotten used to 2FA apps, password managers, hardware tokens and Passkeys; friction is always an issue, but I suppose they can also accept using a “profile center” if they are truly motivated by the quality and benefits of the services.

It's not that different from Bitcoin, if you think about it.

But you certainly have more experience than me at onboarding people, so I don't know what else to say, let's see how the situation evolves 🤞

Derek Ross 2mo ago

That's a fair point that some people are already used to interacting with a secondary app for sign-in. Though, many people still get their MFA codes via SMS and for those that have migrated to other methods, copying some numbers and pasting them from an app that has all of your accounts is still very much different and much easier than a dedicated app for Nostr for signing a wide variety of transfers transactions. If it were as simple as MFA codes, you and I wouldn't be having this conversation.

It's very similar to Bitcoin except people rarely send or sign a Bitcoin transaction. Most people just HODL. We're asking people to do this potentially 1000 times a day unless they go with the fully trusted method. While similar, it's still something most don't do. Remember, we're always preaching for people to remove their coins from exchanges because that's where many people keep them.

I'm not saying I know best when it comes to users and what they want, I'm just speaking from experience onboarding and educating them over the last 3 years. I may not know best, but I have a good idea on their pain points and struggles and I have a good idea on what needs to be fixed and improved to alleviate those.

My goal is to take these experiences and issues and turn them into people that are able to do what they do best. Solve complex problems. Then the feedback loop should continue and these solutions should be discussed to make sure that they're still not too complicated or going to cause more problems or not solve anything at all by pushing the issue into the next bottleneck.

Garbage nsec 2mo ago

Using App A to sign into App B doesn't scale on iOS. It's all hacks that fall apart once Apple takes a look.

And if the goal is to help out normies but it doesn't scale on iOS then consider that goal thwarted.

8e

Valentino Giudice 2mo ago

> It would be extremely confusing for newcomers to use a random app to enable other apps

Not everything must be designed for newcomers.

Newcomers could still use the existing methods.

daniele 2mo ago

Derek's proposal was exactly for newcomers. Experienced users use specific signer, while newcomers often find difficult to adopt them.

Derek Ross 2mo ago

correct, i am just trying to make it easier for new users to explore and use the ecosystem.

PABLOF7z 2mo ago

been asking for this for 2.5 years...

Derek Ross 2mo ago

ManiMe 2mo ago

Hey guys … um…HELL NO!!

Account creation is THE GATEWAY for ALL KYC LAWS. Signers NEED TO REMAIN distinct apps that DO NOT otherwise process events … in order to keep “social apps” distinct and every app immune from prosecution.

The solution will not be simple, but we MUST prevail!!

nostr:nevent1qqsts57k7rwp24rz0942ns5d3zadsqy0malqk59vrvyraj49y2r9stcpndmhxue69uhkummn9ekx7mp0y5erqamnwvaz7tmwdaehgu3wd3skuep0y5erqffjxpshvct5v9ez2v3swaehxw309ahx7um5wgh8w6twv5hj2v3sy5erqctkv96xzu39xgc8wumn8ghj7ur4wfcxcetjv4kxz7fwvdhk6te9xgc8wumn8ghj7un9d3shjtnyv9kh2uewd9hj7ffjxpmhxue69uhhyetvv9ujuumwdae8gtnnda3kjctv9uxvvzez

Derek Ross 2mo ago

The average user will not do this.

ManiMe 2mo ago

nostr:npub1uf9gd9pax7534dy96mu603nqjlp9mht8az73ka0dy54rcfnvlxasumv8xc already does this … albeit a bit rough. I’m working to improve this flow … and add “remote key generation” with “redirect back to requesting client” as a nip for any client to make use of when creating new accounts.

Will be transparent for new users.

https://github.com/nostrband/noauth/issues/338

vinney...axkl 2mo ago

some day it may be necessary to face the ugly possibility that the average user is the problem with literally anything that ever had potential. every effort should be made to meet them halfway - but no further.

Derek Ross 2mo ago

i think that's partially true and it's why better technologies don't always win.

vinney...axkl 2mo ago

they're winning. the benefits are just not evenly distributed.

Which I agree is a shame and its why I said we should meet people halfway.

Laeserin 🇻🇦 2mo ago

The average user (globally) is literally 89 IQ. Many can barely read, write, or perform basic arithmetic. They're overwhelmed by email. In

We might just need to make less-secure and more-censorable Simple Nostr apps for them, that just traps them in a nanny-company offering, and Advanced Nostr for the rest of us.

Those are two different markets.

ManiMe 2mo ago

I buy you a beer and we can talk about it. ⚡️🍻

HoloKat 2mo ago

If you don’t get a response, there’s a good chance no one knows what you’re talking about 🤷‍♂️

Instead of asking, write a clear proposal that states the benefits.

PABLOF7z 2mo ago

I spoke directly, in person, with the devs of multiple clients

HoloKat 2mo ago

Could’ve just nodded along without serious understanding or intent 🤣

fiatjaf 2mo ago

I didn't know you were such a kind:1 maximalist, Pablo, honestly.

PABLOF7z 2mo ago

Pragmatism maximalism

Geektoshi 2mo ago

nostr:nprofile1qqsxr0mepvsfftasxj2uncfk4nmpt0s0enpvh9d44na47mxwlcvtqcsprdmhxue69uhkcmm8v4hzucn5vdnx7unsd3jkyuewvdhk6qgdwaehxw309ahx7uewd3hkcjxcxz5 you are not alone see?

Logen 2mo ago

PixelBob 2mo ago

More difficult to implement, and you don't wanna rush it and leak someones keys accidentally.

Niel Liesmons 2mo ago

Yup. Been on repeat on this 🔁

Daily driver = Signer = Wallet = Notification center = Group Chat/Community focused.

DefiantDandelion 2mo ago

Yes

Marcelinho 2mo ago

nostr:npub1zafcms4xya5ap9zr7xxr0jlrtrattwlesytn2s42030lzu0dwlzqpd26k5 👀

elsat 2mo ago

Yup nostr:npub1xtscya34g58tk0z605fvr788k263gsu6cy9x0mhnm87echrgufzsevkk5s and team view it the same way. Working on pushing a local relay upgrade and other improvements before taking on major upgrade like a keysigner.

Derek Ross 2mo ago

Will is part of the reason that I've been turned on to this method.

Diacone Frost 2mo ago

I think that signers e.g. amber should be the onboarding apps. generate keys and let people to discover apps.

2140.wtf #blockworkgallery 2mo ago

nostr:nprofile1qqsth7fr42fyvpjl3rzqclvm7cwves8l8l8lqedgevhlfnamvgyg78spp4mhxue69uhkummn9ekx7mqpzpmhxue69uhkummnw3ezuamfdejsdy7ycx developed something very fckn cool when you think about it long enough, the entire experience of nostr is going to follow this trajectory.

It is a super app with private chats, ecash payments, easy access to all freedom tech in one place, this is amazing achievement IMHO.

You would like to have nostr:nprofile1qqs24yz8xftq8kkdf7q5yzf4v7tn2ek78v0zp2y427mj3sa7f34ggjcppemhxue69uhkummn9ekx7mp0qyg8wumn8ghj7mn0wd68ytnddakj7fjgzxw with "Signal/MLS protocol to ensure message encryption security and meta-data privacy", but its not there yet

NOSTR DMs suck at the moment across all clients.

nostr:nprofile1qqs8t4ehcdrjgugzn3zgw6enp53gg2y2gfmekkg69m2d4gwxcpl04acppemhxue69uhkummn9ekx7mp0qythwumn8ghj7un9d3shjtnswf5k6ctv9ehx2ap0l2sp3z and now Marmot are definitely levelling up the playing field, allowing for group chats.

"Marmot has the security of Signal with the censorship-resistance and data portability of Nostr

Key features:

End-to-end encryption: Messaging Layer Security (MLS) based end-to-end encryption with forward secrecy & post-compromise security

Upgradable cryptography: Evolve your groups security without breaking existing conversations

Metadata protection: No one can see your social graph or who you communicate with

Decentralized, commodity infrastructure: No central servers to target, easily change your group's relays whenever you want

Scalable group messaging: Works for small teams or large communitiesIdentity freedom:

No phone numbers or email addresses required" - THIS IS VERY IMPORTANT

There is no "one app/client takes it all" fosho, in our NOSTR universe, however direction taken by nostr:nprofile1qqsth7fr42fyvpjl3rzqclvm7cwves8l8l8lqedgevhlfnamvgyg78spp4mhxue69uhkummn9ekx7mqpzpmhxue69uhkummnw3ezuamfdejsdy7ycx improves your daily experience

nostr:nevent1qqsxeg8wwl8f0leeeu9w8amx8ef86tma0jr5nmafuew8ymceartzs9gzyzaljga2jfrqvhugcsx8mxlkrnxvplelelcxt2xt9l6vlwmzpz83uqcyqqqqqqg8p2fqa

nostr:nevent1qqszamycmpeqx5tauz3q54m9snefj8cf944w6280sn9ye03pyjvm5nszyqlhwrt96wnkf2w9edgr4cfruchvwkv26q6asdhz4qg08pm6w3djgqcyqqqqqqglekpjr

nostr:naddr1qqckjmn5wfhkgatrd9hxwttdv9ex6mm5946xsefdve6hgatjv5kk7e3dwdjkxatjv5kk6etnwdskw6twvupzq9eemymaerqvwdc25f6ctyuvzx0zt3qld3zp5hf5cmfc2qlrzdh0qvzqqqr4gu6ud692

Derek Ross 1mo ago 💬 5

IT'S HAPPENING! And it's actually really fucking good.

nostr:nevent1qvzqqqqqqypzq0mhp4ja8fmy48zuk5p6uy37vtk8tx9dqdwcxm32sy8nsaa8gkeyqyj8wumn8ghj7mn0wd68yttjv4kxz7fwv3jhyettwfhhxuewd4jj76twvfhhsqghwaehxw309aex2mrp0yhxummnw3ezucnpdejz7qgwwaehxw309ahx7uewd3hkctcqyqhwexxcwgp4zl0q5g99wevy72v37zfddtkj3muyefxtugfynxayu74sc4h

SondreB 1mo ago

The user needs to scan a QR code with the nostr+connect value, and then keep the second device online at all times.

Instead they can show their key as QR on one device, scan it on second device and be ready to go in a split second - and it all works seamlessly, don't need second device online.

Yes, less secure, more chance of key leaking/stolen, but the UX is better.

Though have a desktop app that acts as both client (viewer), relay (exposed through a relay proxy and acts as backup) and signer, that can just run in the tray, is a good idea.

Reply to this note

Discussion