I can login as you and see who is DMing you

Reply to this note

Please Login to reply.

Discussion

Ah there is already a fix for this using the AUTH spec. Just don’t return DM kinds unless you are a participant.

I think you can do better.

yes and there are many proposals that suggest that as well if we’re worried about relay metadata leakage. The auth thing is an easy first step though and is used for other things as well.