Small story: a journalist, friend, asked me if I could explain what the heck is this NOSTR that the Twitter CEO was talking (sic)..happily, I started to show him how it works, what can you (and can't) do with this and his face was 🤯

- OK, and how do I create my account?

(proceeds to explain and show how to keep their PK safe)

- wait a minute, what happen if I lose my pk or something similar? How do I recover them?

(proceeds to explain how to keep his PK safe part 2 and also some additional info of how I manage my keys)

- Nah, it's too hard and I have a reputation to protect.

Instead of arguing, I just say "ok" but my doubt remains: NOSTR is censorship resistant, protect his reputation means that if he/she make a mistake and their PK got lost, how do they get back? Will they have to all start over again?

That happened weeks ago but, I keep thinking and while I agree with this note, also want to give voice to this specific concern.

nostr:note1yu9d0rnc5tlnym0d0kuy0m7392xjc5s32mv5zxhgwwmwwweu5jushpk4jl

Reply to this note

Please Login to reply.

Discussion

nostr:note1s0ukr83c40k6y3krsr4jxrm7z36pf8m423rp7l5fy2ymlg8gxt3qzwdk52 I think this is the obvious biggest pain point for Nostr. And as far as I can see "solutions" will have to be on a spectrum that ranges between complex/self sovereign <--> centralized/easy.

On the DYI side one has to keep track of a 256 bit number somehow. Seed words, the number itself in a password manager etc. AND one must be VERY careful entering that number into ANYTHING.

On the centralized side of the spectrum, a third party could manage your identity and provide you with a user/password sort of interface. The latter might be doable in a layered fashion. The central authority could use a set of validation tools so that if something is lost or stolen it can SEEM to be retrieved by validating another NPRV in their database. In other words they become a validator middleman for identity.

In a way the metaverse bridge is already a working layer on NOSTR. And there could be other systems that handle identity in a more centralized way on TOP of the fully free protocol for those who want or need that.

Now of course many of us find the latter path negative unto revolting. Because we are realizing what NOSTR is is entirely about identity in the first place. But folks like that journalist might find navigating NOSTR much more easy if it worked this way.

This is essentially the same problem bitcoin faces. From the beginning the acolytes of the network have chanted "Be Your Own Bank"! But the thing is not everyone is prepared or even capable to make the sacrifice to do this safely. And even those of us who are well versed in the intricacies of key management feel that well known bolt of fear in our gut when we move all our value to another address. Let's try a little bit first! OMG! Did it work? Whew! ;) When was the last time I did my multisig disaster recovery tests?

Like Bitcoin the revolution is NOT that everyone on nostr MUST use the system in a self-sovereign way. It's that they CAN. And whatever layers we build on top to provide folks with suitable tradeoffs we must never lose that core.

Maybe we need centralized services for people to store their private 🗝️ key in a "safe" centralized server under pasword123 so they can never lose it. Then we can offer them "forget password" button and they'll be happy that we store their private key in a plane text

😆

nostr:nevent1qqsg87tpncu2hmdzgmpcp6erpalpgaq5na64g3sl06yj9zdl5r5r9csprdmhxue69uhhyetvv9ujummjv9hxwetsd9kxctnyv4mz7q3qpps3gnrkt6ssuwdys3e62xlwvpygdcv2h58cx8x9a4m9re52rjhsxpqqqqqqzgys7xn

Apart from the fact that “they can never lose it” does not exist. Its just a responsibility one can do better and other can do worse

There are always people smarter than you, but most of the time there are no people more interested in something important for you than yourself

And choosing right balance is your responsibility even if you try to avoid it

'Nostr for normies' App??

Thats what ZBD's approach seems to be

If a lock can be bypassed, it is a less secure lock.

If a man does not defend his own home, he is not free.

I always laugh when people say funny things like, “I have a reputation to protect”😂 It’s cute meat bags think so highly of themselves.

We can scan our eyeballs? 😝

How can we have zero-knowledge recovery that is user friendly?

SLIP-39 Shamir’s Secret Sharing.

https://github.com/satoshilabs/slips/blob/master/slip-0039.md

People implemented this like 10 years ago for scuttlebutt, right nostr:npub1wmr34t36fy03m8hvgl96zl3znndyzyaqhwmwdtshwmtkg03fetaqhjg240 ?

Yep. We could use it in nostr apps too.

https://darkcrystal.pw

Nostr seems especially good for that use case because Shamir’s Secret Sharing requires messages to be broadcast as far and wide as possible (prioritizing data availability over all else). Put up the bat signal lol

Oh nevermind actually. I was wrong. Privacy is actually better in this use case

> peer-to-peer protocols are naturally better suited to secret sharing, due to there being no central server that can be surveilled to detect the possible combination of share-holders that a secret-owner might choose

Thats why normies dont get it. THey want big daddy protecting their account.

If he gets locked out of his account bc he lost his private key, that's still better than being locked out due to being censored.

He can spin up a new account and is good to go.

Teach him how to back up his posts -- someone recently posted a note about this. I think I bookmarked it...

It's not super important to me. But I'm not a journalist and my goal isn't to be an influencer.

Unless this friend with "reputation" changes his way of thinking, I can do without nostr users like him.

In other words: he is not ready yet, no need to rush things.

What you describe is a problem indeed. Nostr is not and will never be a solution to this problem. Nostr is one of the tools to solve completely different problem

Once one realizes he wants to be responsible for his identity, nostr (or alike) is a no-brainer

Until one doesn’t want to bother with responsibility and would better delegate it, nostr (or alike) will never beat a centralized solution

Surely they can just create a new keypair and transfer their verification details across to the new, upon doing so this would be removed from their old identity and they could add a statement in the bio with their old npub?

Wait… if I lose my Pk do I die in the real world?

According to these crazies

This is the beautiful thing about Nostr.

Once the Normie gets over the fact that their Nostr account is protected by a very complex secret, they're primed for Bitcoin.

Nostr requires some user responsibility. The risks are low & the benefit is permissionless expression. As the ban hammer swings, more & more will see the Nostr value proposition.

It's a sly roundabout way to get people comfortable with responsibility. This is the only way to freedom.

I think about the fact that I cant get my twitter account back and never lost a password to it. I imagine if I were important, or my income was based on social media monetization that the impact could be devastating.

At least with Nostr I can have some attestation that doesnt exist with centralized services. From a lost/compromised key with a reputation built to new one, Id rely in large part on updating the NIP05 from domain I control to reference new pubkey, and list of people i follow to help spread that update.

But we're lacking a standard to do this. Even when NVK accidentally deleted his account it wasnt all that easy to sort through that. Without it being dead simple we can count on most users giving up with nobody to call/email before they sort out what to do on their own.

get better friends

fuck private keys, it is fiat mindset to cultivate your online persona, and capitalize on your past posts and online reactions. zuckerberg and the failed social media lead people to think this is the way. no it is not. if I lose my bitcoin I would start stacking from zero. if i lose my nsec i restart. The sancticity of a persona is actualy hubris born in the bygone era. if you are something you rebound quicker anyway.

Instead lure him with zaps. zap is the standard