So review our key handling practices, but it's still impossible (or deprecated) to actually have good ones...?
Discussion
thoughts?
cc: nostr:npub180cvv07tjdrrgpa0j7j7tmnyl2yr6yr7l8j4s3evf6u64th6gkwsyjh6w6 , nostr:npub1l2vyh47mk2p0qlsku7hg0vn29faehy9hy34ygaclpn66ukqp3afqutajft
nostr:note12uj0j60pvzjtaaw2q2rqqc87y7lgwhqtpw06thahf5sqmxmftt8qqhqg4s
do you think using delegated event signing (at least the way mentioned in NIP-26) is the best practice of managing our keys?
Key delegation and revokation (or even better, rotation) are badly needed, but NIP 26 isn't it.
Some recent discussion on the topic: https://github.com/nostr-protocol/nips/pull/1452
I'm sure your perspective on the problem would be very welcome.
How does it currently work? Do nostr clients store the private key on their servers after it's submitted by the user?
Usually it's stored in the app/browser, hopefully never on the server. You can also use extensions like nos2x or alby to protect your key from the app, or you can use NIP 46 signers like nsec.app or Amber to hold your own keys and sign remotely.
Thank you for the explanation. I'm looking at the NIP-46 doc and it's really a neat solution.