Amber integration via NIP-55 is coming later this week, I mentioned this a couple of days ago. In the meantime , Amber integration via NIP-46 has been possible since day 1
Officially enrolling nostr:nprofile1qqs8l7cf847rw8vkkhta7v8faa066r5le7dds8tgnau7ng2d74ey2cgpz4mhxue69uhhyetvv9ujuerpd46hxtnfduhszrnhwden5te0dehhxtnvdakz7qgnwaehxw309ac82unsd3jhqct89ejhxtcymzaec in #nsex because the feature was announced, but doesn't actually work and we've gotten no response. You're in good company tho, cuz nostr:nprofile1qqs9xtvrphl7p8qnua0gk9zusft33lqjkqqr7cwkr6g8wusu0lle8jcpp3mhxue69uhkyunz9e5k7qg4waehxw309ajkgetw9ehx7um5wghxcctwvsqs6amnwvaz7tmwdaejumr0ds2g5zx8 and nostr:nprofile1qqsth7fr42fyvpjl3rzqclvm7cwves8l8l8lqedgevhlfnamvgyg78spzpmhxue69uhkummnw3ezumrpdejqz9rhwden5te0wfjkccte9ejxzmt4wvhxjmcpp4mhxue69uhkummn9ekx7mqqdtrej are here too.
Devs know key rotation doesn't exist but still want us to trust them and paste our nsec all over the internet, and I'm tired of it. #NameAndShame
Discussion
Nip-46 requires the signer to be online, which is insecure. My nsec is precious and live inside of an application that has no network access incase the dev introduces malicious code to expose it.
When you mentioned Amber login, did you mean login via NIP-55 (Android Signer Application) rather than NIP-46 (Nostr Remote Signing)? I believe Amber implements both NIP-55 and NIP-46.
55, amber can be denied network access so I find that secure. 46 would be cool if there was a hardware device like a ring I could just tap with another finger to approve, but I haven't seen that yet.
In the NIP-46 protocol, the signer that stores the nsec does not expose the nsec. It only receives signing requests, completes the signing, and then sends the result out.
nostr:note1zhvanadlce4fm2svryk9e3wvw97q066zlq27wn9lcjav3lau5klq8f4mwh
Yes, but how is it the signing done? Via network comms right? So if the signer requires network access to work, then the dev pushes malicious code to publish the nsec, there's nothing you can do about it. Whereas nip 55 I can box up the signer with 0 network access so even if malicious code is pushed, it can't be transmitted.