Replying to Avatar Ava

Nostr focuses on censorship resistance with privacy as an afterthought, while tools like SimpleX focus on anonymity and privacy. Do not confuse the two.

Not every Nostr client or relay implements the same NIPs. NIPs are optional by design—relays choose which ones to support, and client implementations vary. You could set up a private mute list on Amethyst only to find it doesn't carry over when you switch to another client that implements it differently or not at all.

As for messaging: NIP-17's "optional forward secrecy" refers to disappearing messages via expiration tags—not cryptographic forward secrecy. NIP-17 doesn't solve forward secrecy or post-compromise security.

If your Nostr private key is compromised, all your DMs (past and future) can be decrypted because the same key is used throughout. SimpleX doesn't have this vulnerability because it uses no persistent user identifiers. In serious privacy circles, SimpleX is consistently the recommendation.

I know SimpleX recently became controversial with the Bitcoin maxis on Nostr with their Community Vouchers launch, but the underlying protocol and privacy architecture remain technically sound.

There's nothing wrong with using Nostr non-anonymously—but understand what you're using it for. This isn't Reddit.

I firmly believe in and teach privacy and security through isolation and compartmentalization. Use the right tool for the right job. If you want censorship-resistant public discourse, use Nostr. If you need anonymous private communication, use SimpleX.

Treating Nostr like an anonymous platform when censorship resistance is its focus with privacy as an afterthought is a fundamental misunderstanding of the core purpose of the protocol.

nostr:nevent1qqs82u5gxj95wdnv822my8a4l7duhjvltchdvpyafg3q2efkdv8f5cgpz9mhxue69uhkummnw3ezuamfdejj7q3qf6ugxyxkknket3kkdgu4k0fu74vmshawermkj8d06sz6jts9t4ksxpqqqqqqz3ez3rt

and if you're looking at SimpleX check out Cwtch.

Reply to this note

Please Login to reply.

Discussion

I tried to use it a couple of years ago and found it to be highly unstable and barely usable.

I will revisit Cwtch one day, but not with anything mission critical yet. Interestingly the developers announced on SimpleX, not Cwtch, that they planned to undergo a security audit by Trail of Bits in early 2025.

2025 is nearly over and there has been no public report of a completed third-party security audit.

Due to the experimental nature of the app and the fact that they still haven't had—much less passed—a formal third-party security audit, so...

Sure, all this stuff is hard. I'd agree that Cwtch is not ux focussed! As for these apps and mission critical..... Let me think about that a while. ;)