Can't you still be XSS'ed even from a local webapp if the malicious scripts phone home your private key?

Reply to this note

Please Login to reply.

Discussion

yes. which is why I'm authenticating with alby and disabled the 'dont show again option'.

I need to authorize every single action.

not perfect, but good enough for testing

I don't remember damus web supporting alby signing, nice to know.

it does, seamless just like astral. :D