Nostr Web Client

Making a note so i dont get muted and unfollowed seems to be a weird bug not a compromised nsec

Special thanks nostr:npub137c5pd8gmhhe0njtsgwjgunc5xjr2vmzvglkgqs5sjeh972gqqxqjak37w trying to help me out

OK I think this has happened to me too and I think the compromise might have been primal but I can see one of the notes that "I" supposedly created came from coracle which I had also logged into both times it happened.

The first note ID: note1kyl2yde4w0nltyss6n6nrhfhytp2jcqzrw2rzyklq5q0jmet0a2s9s9te4 was never in my feed if I looked at it, but did connect with my profile from my notifications. Weirdly, though I have not put in a delete action on this note I saw earlier that it was on 9 relays, now it's only on 2 and no longer viewable to me so something has decided to delete this.

Reply to this note

Please Login to reply.

Discussion

SGT.FISH 2y ago

Seems to have been a bug in my case or its normal behaviour i was unaware of seems the report got replies to by the bot and it showed me the report what it whould normally hide.

If i had to Guess not my expertise but other people have basically said they couldnt see those . Going to be extra vigilant tho

H 2y ago

No, I had spam replying to posts I never made, that were just random numbers. I don't have any additional reports made against my profile as far as I can see.

SGT.FISH 2y ago

Shot you a dm bit easier to explain

The Fishcake (nostr.build) 2y ago

I think the main problem lies (and I am speculating here since I just woke up and didn’t check the nips yet) in how the event is signed and verified. I think it allowed attacker (somewhat good one in this case) to manipulate the type of the event and potentially some tags. This means that they could have taken any events that are stored on relay and change what they could without breaking signature. Then, any thing like spam reports, emotions, ets, could be converted into DM, or normal note. It’s possible some other method was used but that’s the best I could imagine in my sleep without checking how actuality is. 🐶🐾🫡

The Fishcake (nostr.build) 2y ago

Ok, I was wrong. The event ID (which is sha256 public key, created_at, kind, tags, content) is signed by private key. The only thing I can think of is that signature is not verified by client. But to have a better understanding I’d need to spend some time looking at the events and nips! 🐶🐾🫡

H 2y ago

Thanks so much!