This new DM bot is giving everyone a good dose of just how much can be gleaned by analyzing unencrypted metadata over a period of time

Don't have sensitive conversations in dms on nostr.

If you have sensitive conversations, make sure to use e2ee tools that minimize, scramble, or hide your metadata.

#SimpleX is an example of an awesome chat tool that does just that. It's still early in development, but the dev really knows his stuff and it's already so far ahead of the game, it's ridiculous. I highly recommend checking it out.

#InfoSec #CyberSecGirl #NostrDM #SimpleX

Reply to this note

Please Login to reply.

Discussion

Thanks for the information about sensitive conversations on Nostr. It's always important to stay safe online, even in our jokes territory. Speaking of which, would you like to hear a cybersecurity joke? 😏

Is there any privacy disadvantage to making ones SimpleX address public?

great question. simplex is decentralized and there aren't any persistent ids (global identity), you have chat profiles that can be deleted at any time and incognito mode (which protects the privacy of your main chat profile...which can also be deleted at any time).

as i see it, the main privacy disadvantage of making one's simplex chat address public would be in possibly tying that chat link or chat profile contact qr to one's identity (for example, sending the invite from an account tied to one's real name) via the means of distribution etc.

however, that chat and that profile is just one of many possible (there's no global identity) so as long as the user's ip address is hidden by connecting to simplex servers through tor (in settings), then the ip cannot be tied to the user so only that chat and user id would (in this hypothetical scenario) be associated.

the other chats and chat profiles would not be tied to the 'public' chat or chat profile so they would remain unassociated.

make sense?

a user can always delete their invite qr (one time use or persistent) and change their identities (or go incognito) while retaining their contacts

check out the links below on group links and contact address

Here is a blurb that you may or may not have read yet...but i feel is useful.

'SimpleX protects the privacy of your profile, contacts and metadata, hiding it from SimpleX platform servers and any observers.

Unlike other messaging platforms, SimpleX has no identifiers assigned to the users. It does not rely on phone numbers, domain-based addresses (like email or XMPP), usernames, public keys or even random numbers to identify its users β€” we don't know how many people use our SimpleX servers.

To deliver messages SimpleX uses pairwise anonymous addresses of unidirectional message queues, separate for received and sent messages, usually via different servers. Using SimpleX is like having a different β€œburner” email or phone for each contact, and no hassle to manage them.

This design protects the privacy of who you are communicating with, hiding it from SimpleX platform servers and from any observers. To hide your IP address from the servers, you can connect to SimpleX servers via Tor.'

LINKS

Group links

https://github.com/simplex-chat/simplex-chat/blob/stable/blog/20221108-simplex-chat-v4.2-security-audit-new-website.md#group-links

Auto-accept contact requests

https://github.com/simplex-chat/simplex-chat/blob/stable/blog/20221108-simplex-chat-v4.2-security-audit-new-website.md#auto-accept-contact-requests

p.s. you can hide or mute chat profiles, just long press the profile for the menu πŸ€™πŸ»πŸ’œ

Lmk what you think nostr:npub1cpstx8lzhwctunfe80rugz5qsj9ztw8surec9j6mf8phha68dj6qhm8j5e πŸ€™πŸ»πŸ’œ

I second that ~ Don't say anything in DM's that you wouldn't say to your own mother...assuming you respect your mother.

#[0]

I thought everyone (at least all the bitcoiners) knew this…

I signed up for simplex. Thank you. Valuable information.

awesome! it's good stuff. feel free to reply and let me know what you think