Good morning. ☀

Late last night I acted quickly to alert Nostr when I realized many of us were under a targeted attack. I have received some criticism for exposing the method that was used to reveal thousands of email addresses from Alby’s user database.

I realize could have handled it differently, but I did what I believed at the moment to be the best interest of disclosure to help others. From what I could tell, the majority of damage had already been done.

The email/password login feature has since been disabled, but anyone who already received an unexpected password reset should consider their email address doxxed.

I do not believe there are any further risks. If you are using the browser extension, your nsec was not exposed by this, because that information never left your possession. This was simply a scrape of Nostr Lightning addresses used to exploit a vulnerability in a login function.

There is a lot to be learned from this by everyone.