Thinking through groups on nostr for communities that put a premium on privacy, and I'm not sure it's going to work.

You can get privacy of communication via relay authentication or encryption. But a starting point for identifying each other is to publish a public profile, which might not be desirable. And you might want to use your real name in a community, but not in public.

I'm just imagining asking a little old lady in my church (assuming she can get past the cryptographic key pair step) to permanently publish her name and picture to 8 billion people on the internet in order for her to get access to announcements about after-church potlucks. It just doesn't make any sense.

Having a single profile for your online identity violates the "selective revelation of self" principle. Even if you use different keys for different things, you ideally are only going to want to share your profile with certain people.

A possible solution to this is encryption-by-default. Only send your profile to the people and communities you want to reveal yourself to, AKA the Google+ circles model.

Have I been barking up the wrong tree this whole time? I know some people have said "nostr is for public data". I still don't completely believe this, but it's harder to work against the grain than I expected.

Reply to this note

Please Login to reply.

Discussion

What happens to our information when we change our names in the edit tab.. asking for a friend.

I always thought that private groups could just have their own little walled garden that doesn't interact at all with the rest of nostr. A single relay or a small group of relay dedicated to only that group.

Are you thinking that is too big of a lift to start up? Or is this problem just way more complex and technical than I can appreciate?

I know you have been working on this for a long time and are 10000 layers deeper than I'll ever be, but are there tradeoffs that seem too big but maybe aren't as bad as you think?

I think it could be "solved", but privacy is essentially working against the grain of nostr. Put another way, if you don't want to reveal yourself at all you're not interested in the open network value proposition nostr offers, and so there's no reason to use nostr instead of something more centralized.

Yes that would be centralized, but it would still be open source. And you could still bring your keys with you when you go outside the group (even if your profile stays in the walled garden group). Church groups can totally be centralized... Who would push back on that?

Yep, agreed, it's just a matter of where to use which profile at that point

I can see the feeling of trying to bang a "square peg through a round hole" with this. I think it's a reflection of the general tension between social networking as a "public square," and the privacy-centered values of a lot of bitcoiners.

One thought I had is that this is reflective of the "blockchain without Bitcoin" arguments from ~10 years ago. Everyone thought "hey this Blockchain thing is great, but can we do that without all of this messy Austrian monetary stuff?" So people started trying to put all kinds of things on a "blockchain", property titles, shipping manifests, etc.

As it turns out, most of that stuff was just better on an SQL database. The key was that there was no actual need for decentralization, and the inherent slow-down associated with proof of work (even PoS).

I wonder if that's the case here. Private groups are something that only needs one server and one centralization authentication model.

Not everyone wants to share publicly. This is why most social platforms have private profiles and posts. This also mimics real life too.

Yeah, I think "private by default" is actually a really good way to go unless you want the open discoverability that something like twitter offers. But comparatively very few people use twitter vs facebook, which sort of pretends to respect your privacy

Another thing: not that the House of Zuck is the best role model, but hasn't Facebook required actual, real-name identities to use the network since basically the beginning?

Perhaps if "private groups" means not even knowing that the user has an identity on the network, the best model is something closer to a "Fediverse"-style private instance?

Yes, and it's one of the biggest violations of privacy in history. They tricked normal people into revealing way too much about themselves. But yeah, fediverse might actually be a better solution for certain types of groups (although I'd prefer something encrypted).

I always thought about npub as something like an IP address. You can't hide it if you want to communicate. It's part of a network packet. Sure, you can use a different one, but then all old connections stop working.

You can wrap it into a frame and use some "mac address" for local delivery. Then some relay/client need to understand this protocol.

so it's basically what we already have without nostr. routers are relays. ips are gateways and mac address is your npub

if it makes any sense

Yes, but IP addresses don't have your face on them

I mean we could use the same thing. make your (real) npub a mac address. only local network will know it.

wrap it in the network layer (can be even shared by a group) and send via public relays.

something like we do with DMs

It depends *where* you publish your profile.

Why does the little old lady have to publish her profile anywhere publicly for it tow work on a private hosting set-up?

Btw: anyone that types your phone number into WhatsApp can see your face too. They're just not having all that easily available on one open server. We shouldn't neither.

Just publishing to your group's relay would work (sort of), but it demonstrates the more fundamental problem, which is: why would I ask people to jump through a bunch of hoops to use a decentralized system, if they're not interested in the public broadcast part of it, which is what requires all the centralization? Might as well have custodial identities and a familiar setup. Other than the fact that people need nostr and this is a first step that direction. I just can't sell a product if there's no value proposition.

In my opinion because of two things:

- The inherit benefits of having one protocol that apps can agree to and build for.

- The fact that relying on one identity means that even if the centralized server runner goes away, for whatever reason you still have access to your data, and you can still create more data.

If this is paired with a community building software that encrypts all data before pushing it up to nostr and stores it locally, then you have the best, uncensorable, private and unstoppable tool for communities.

Agreed.

That first point is a big one. For me #interop is the :trophy: feature. The fact all these apps speak the same social-data-format language.

It's not because most current apps assume you want to scream everything you do out into the void, with zero target, that we can't build apps that let you share to specific groups.

It depends on the tool you use.

With closed community networks, nostr acts only as a way to send data and as a standardized way to encode information.

Closed Community Networks allow you to be as private as possible, and allow that same old lady at your church to virtually join her parish's network and interact closely only with those people, and no one else.

Anyone who isn't in her church will not be able to see anything she shares because as far as they're concerned she doesn't even use nostr and doesn't have a public profile!

💪

I'm on year 4 of working against the same grain. This year I started building the client I wanted to build- and I realized just how difficult this seems to be. I think the most difficult part is how many clients have approached things in generally the same way. We see micro innovations a lot, but rarely macro innovations in app design.

To me, relaytools and flotilla represent macro innovations and fundamental change. They acknowledge how things can work different if we choose to work differently.

My drafts relay is totally private. No one can access it but me, and I have no need for profile metadata there as a result.

If I invite someone to share it with me- it would no longer be a "private" relay. Though if my one shared user doesn't leak my data, my relay is still inherently private between the two of us.

Privacy is not free. It is not assumed. It is something that requires initial effort and sustained efforts.

Where I find the biggest problem to be, is with NIP-07. We are all trapped in a framework of "one npub = one user".

The alternative is to custody keys within parent keys. I think this was avoided at the beginning because it seems extra confusing, and really offers a "centralized point of failure" for "multiple accounts" by the same user.

However what it does is ensure each profile across the network is separate. No one would ever possibly want that... Would they?

I would, actually. The same way I might create throwaway accounts on social media. The same way I have dozens of emails, both throwaway and permanent. The same way I use many social medias and not just one. The way I use a password manager in the real world and don't smash my nsec into a steel plate or an offline signer.

Nostr is trying to do too much with too little. The protocol works well but relays suck. Websockets suck. Blastr sucks.

We either address the elephants in the room or silently stand by while innovation is crippled.

I read this post many times since you created it and I watched the replies.. then I took a nap.. I tried to respond a few times and there are many points I'd like to make.

What I see is a need for segregation amongst the ecosystem. I have always seen this and continue to see it. Users WANT some level of segregation. We NEED communities in some fashion. My solution is to lock relays down and deal with the repercussions, because I don't think the Nostr we have is the Nostr we want.

But I am hopeful. I am here to experiment and find what works. People may not like my first attempt, and I might not like it either, but I think it's worth a shot.

I think we should be importing our profile metadata, PER USER REQUEST, to each new keypairs we spin up. This was we can custody profiles that both do and don't inherit profile metadata from our master key.

I would like to go into more detail but I don't want this comment to become a trainwreck of "what ifs".