Nostr Web Client

And once your key is compromised once, everything you own is compromised.

This idea flies in the face of good security practices - don’t use the same password for everything. Especially without key rotation support. At least with oauth you can change your password and revoke sessions.

I don’t see this as an improvement.

Matthias 1y ago

Is there a NIP for key backup and recovery to handle situations like this?

One clear protocol would be: create a master key locked in a vault or whatever, and have other lower security keys. But you also need a two-way signed attestation:

- master key: I control this other key.

- other key: I am controlled by this master key.

That signed attestation could be a VC that could be presented at any time to a compliant nostr client, for account recovery.

... but it would also need to be visible and supported by all consumers of your data that was assigned by your old key.

Reply to this note

Please Login to reply.

Discussion

Laeserin 1y ago

We have key delegation, but I don't know if that could be used for this.

Matthias 1y ago

Yeah it looks like NIP-26 "Delegated Event Signing" can be used for this.

The delegator would be the master key, and the delegatees would be the low-security keys.

It doesn't look like there's a revocation mechanism, and delegation has time bounds, so you'd need to generate new delegatee keys periodically. Which can be an airgapped operation.