Nostr Web Client

I love the idea and will probably test it for some small stuff. The only feedback I might give is that one potential downside is the the encrypted data is publicly available, which isn’t true for a normal password manager.

Of course the data is still encrypted, but there are some concerns. Leaked keys and passwords carry much higher risk since it’s guaranteed that the hacker already has access to the encrypted content. Phishing attacks may be extremely prevalent and people need to be extremely careful of the client implementations.

Again, I love seeing new implementations on Nostr and have always thought a password manager would be interesting, but want to make sure we are talking about all the potential risks! Would be curious to hear your thoughts on these issues and how they could be mitigated

Jingles 2y ago

Hey. In my next version which is currently being review. It has a bit more explanations in the FAQ section.

I’m short, it’s pretty save in my opinion. Because it’s is encrypted twice with 2 different things.

You need to lose your secret key, and also the password. In order to lose your data.

Also, if the community and user base likes it, I have plan to include one time password, so you can encrypt and decrypt with google Authenticator (or equivalent).

Reply to this note

Please Login to reply.

Discussion

armstrys 2y ago

Authenticator would be a great addition IMO - especially if you can do physical security keys using U2F. Looking forward to the FAQ and congrats on the release!

franzap 2y ago

Congrats Jingles! What would be awesome is the ability to derive passwords ala LNURL-Auth instead of storing them - reducing considerably the attack surface. But still use nostr for usernames and other metadata

Derivation could be a password that satisfies the most typical requirements such as 8+ characters, uppercase, symbols, etc

Jingles 2y ago

Mmm, that sounds 🤯

Keen to learn more and understand what you mean by using LNURL auth to derive passwords.