We need to develop a system of parent and child keys on #Nostr that can be managed by an admin key. This admin key could potentially utilize multi-signature functionality for added security.

This system would serve two important purposes:

1. It would eliminate the need to create a new npub (public key) in case of a compromised key.

2. It would be particularly beneficial for businesses, especially those that outsource their social media management.

Many businesses hire external individuals or agencies to manage their social media accounts. If any of these individuals compromise the key, either accidentally or intentionally, or attempt to retaliate against their former employer (which has been known to happen), the admin key or keys could lock the child keys of those employees when they no longer require access to the account.

It's unreasonable for businesses to have to navigate this vulnerability when the consequence of failure is having to start a new npub. A hierarchical key system would provide a much-needed solution to this problem.

Reply to this note

Please Login to reply.

Discussion

Interesting idea could be very useful.

I wonder 1) how many businesses are on nostr and 2) have it as their primary social. Wondering if there is some way to track the # of businesses on nostr. Would likely be a crude metric I guess.

I also wonder if these sub accounts could have diff posting permissions. Like top level posting and 'reply only or DM only' posting.

Gonna post a NIP?

Lack of key rotation seemed microstrategy’s objection to nostr

completely agree. 100%. been bitching about this

Booo JBOK is more fun; feels like the good ol' days

There are already some initiatives in this direction:

https://github.com/nostr-protocol/nips/pull/1450

#subkeys ... many of us have been saying this for a long time

Have made a couple of notes to this affect, would be a game changer for account security.

Could nsubs expire (after say 24hrs) the nroot just updates it over another service simplex etc.. No need for extra computation then?

Yes! The note below is where I first started thinking along the same lines as you. Having been at an agency where brands were navigating social account permissions, the nsec/npub pair alone will be a nightmare.

nostr:note1ssw0ejacstp6ygtjltl7r0npnnx53a7nxtzvdyuxszclm6lc62gsq9mydx

Here’s the current draft of the idea…

https://github.com/swbratcher/nips/blob/master/NSUB.md