Nostr Web Client

Derek Ross 2y ago

Hey! Are you a new Nostrich? Are you practicing safe nsecs?

https://void.cat/d/Ujcm7u44K6uqrcT2K5YGaK.webp

You should never enter your nostr private key (nsec) into web clients. Think of this as your password, but you can't change it, and it's used to post all of your events and notes on nostr. It's very important. You need to keep it safe!

So, if you're using a web client such as snort, primal, coracle, satellite, or iris etc., you should not be entering in your nsec private key into these websites. It's just good security practice! Some web clients won't even function or allow you to sign into them unless you're using a Nostr extension (sometimes referred to as NIP-07).

To help you and your private key stay safe, you may use a web browser extension to hold your key for you and sign your events and notes on nostr on your behalf. The two most popular ones are nos2x and Alby. Nos2x was developed by nostr:npub180cvv07tjdrrgpa0j7j7tmnyl2yr6yr7l8j4s3evf6u64th6gkwsyjh6w6 and is very basic, but to the point. nostr:npub1getal6ykt05fsz5nqu4uld09nfj3y3qxmv8crys4aeut53unfvlqr80nfm has some nice additional features included, such as a being a Lightning wallet, giving you a Lightning address, and a Nostr address.

I personally use them both for different situations. On desktop, I use Alby. On my Android phone with the Kiwi browser, I use nos2x.

If you have questions, do not be afraid to ask! 🤙

Reply to this note

Please Login to reply.

Discussion

CARLA⚡️ 2y ago

dammit Derek this picture just ruined my morning for inexplicable reasons!!!

Derek Ross 2y ago

you're welcome <3

Was not aware of this. What’s the best way to undo?

Sign out of all web clients, clear browser cookies and cache?

Thanks for the info 🤝

Real Trader 🦈🫶 2y ago

Eu também quero aprender mais sobre ✌️

Derek Ross 2y ago

sure. see my response to the original question. if you have any other questions let me know.

Derek Ross 2y ago

if you entered your private key into a website, most likely that private key is stored in your browser cache. nuking it all would be all you would need to do. you'd most likely be safe then once you started using an extension.

that said, last December nostr had a bunch of cross site scripting attacks on a popular client at the time. those keys were considered burned and many people abandoned those keys for new ones.

i personally don't think you'd have that problem today with any of the popular clients though. i just wanted you to be aware of it.

네딸바 2y ago

we are not late 😁

nostr:nevent1qqswee6xff42072tgh3cd3pjwz926t9pjeafkwj54h9se3ehwlt722qpz3mhxue69uhhyetvv9ujuerpd46hxtnfdupzq0mhp4ja8fmy48zuk5p6uy37vtk8tx9dqdwcxm32sy8nsaa8gkeyqvzqqqqqqy0qcvvp

Newbies on #nostr. Take a look at this

nostr:note1ann5vjn25lu5k30rsmzryuy245k2r9n6nva9ftwtpnrnwa7hu55qm449ku

Diego Valley 2y ago

Thanks derek. What about for iOS?

Derek Ross 2y ago

iOS has an app in the App Store called Nostore that acts as a signing device for Safari.

Roboto Saith 2y ago

Will it be possible to have child private keys that can be invalidated and a master private key that stays offline

Roboto Saith 2y ago

Offline as in bitcoin private key offline, not in huer computer

Roboto Saith 2y ago

Of course without changing huer identity 😅 sorry must have thought a bit more about my question

Derek Ross 2y ago

Essentially, yes. Check out nostr:npub1l2vyh47mk2p0qlsku7hg0vn29faehy9hy34ygaclpn66ukqp3afqutajft 's nsecbunker.com

Good stuff to know about nostr key management....

nostr:nevent1qqswee6xff42072tgh3cd3pjwz926t9pjeafkwj54h9se3ehwlt722qpz9mhxue69uhkummnw3ezuamfdejj7q3q8ams6ewn5aj2n3wt2qawzglx9mr4nzksxhvrdc4gzrecw7n5tvjqxpqqqqqqzcwp7va

get a room!

Derek Ross 2y ago

oh sorry, I didn't know they were males

oh sorry, I didn't know they were males

I have created "Delegation.Monster" as web based remote signer that also supports browser extensions. Soon with Delegation functionality.

https://delegation.monster

I'm grateful for the advice reg nos2x on android, but you mention kiwi browser - is nos2x compatible with brave, or am I going to need a new browser just to run Nostr bits?

Derek Ross 2y ago

The only Android browser that supports extensions is Kiwi as far as I know. It works with Brave on desktop though.

Cheers, I had a funny feeling...guess I'm getting a new browser then - cheers!

Sats paa BTC 2y ago

Does anyone know of a way to go from a hex to a bech32 format? I have my secret key in hex format, and I'd like to check out the Amber app by nostr:npub1w4uswmv6lu9yel005l3qgheysmr7tk9uvwluddznju3nuxalevvs2d0jr5 but it only workswitkh nsec (bech32). I don't have access to a Linux PC!

devsou.com 2y ago

I just installed the Kiwi browser on Android and the Nos2x extension, but I can't enter the private key. It's impossible, I can't find the options for this 😭😭😭

Derek Ross 2y ago

It's a pain. Go to extensions, then nos2x, then details, then open extension website.

I've managed to get that far - it opens the GitHub page, scrolled down and saw what I assume is the next instruction;

1 & 2 are fine, then there's:

3 click on "Load unpackaged";

4 select the extension/ folder of this repository.

There's nothing on the screen that says "load unpackaged".

Derek Ross 2y ago

oh you're using the version from github. that's fine. if you go that route, you need to enable developer options to allow loading of unofficial extensions.

Think I might have to go back over everything and start again - when I searched the extensions via kiwi I must have clicked the wrong one...it's fun getting used to all this

Derek Ross 2y ago

https://chrome.google.com/webstore/detail/nos2x/kpgefcfmnafjgpblomihpgmejjdanjjp

Many thanks 🙏

Derek Ross 2y ago

yw

devsou.com 2y ago

Many thanks, it works! Greetings from 🇧🇷

Derek Ross 2y ago

you're welcome! greetings! glad to see you on nostr!

Just adding to the pile … if you have to for some reason copy an nsec into a browser… copy something random afterwards … keeping your clipboard clean 🧼 also … a Followup question how do Nos2x and alby sign stuff with the secret key without it being exposed ? Multi keys 🔑 🔑?

Derek Ross 2y ago

They don't pass the key to the website. They sign the transaction and present the signed transaction to be broadcasted. It works exactly the same way as a Bitcoin wallet works. If you've ever used a Coldcard, Ledger, Trezor, etc.

So glad I haven’t been talking out my ass this whole time.

Derek Ross 2y ago

🤔

Sorry, context. Lol. I thought that was how it worked based on what I’ve read, but you’re the first smart person I’ve caught saying it in my feed. 🤣

Derek Ross 2y ago

So, we need cold storage/hardware solutions for nostr nsecs. Why provide the private key to alby? just for convenience? Isn't the risk the same?

Derek Ross 2y ago

we have them... you can get one from the lnbits shop 😉

Also what I was wondering 🙂I figure it’s about trust. Nos2x probably will be safest 😂

Well so far I’ve implemented Alby/Nos2x for the NostrDam meetup but haven’t build any signing parts yet so I only readout the pubkey 🫡 thanks for the update 🔥

https://production.flamewerk.com/keys its a bit rough of a playground but has all the conversations 🫶

Why you gotta pick on us web clients all the time? You can get rugged just as easily on mobile.

Derek Ross 2y ago

🤣 You are correct. This hasn't happened yet to the best of my knowledge? This did happen with a web client though last year though.

Yeah, that was a shame. I'm not aware of any client-side key leaks yet, it seems like we've managed to avoid bad faith actors so far.

MonkeyRidesBike 2y ago

Derek Ross 2y ago

hot.

deafhorse 2y ago

How can I access the nSec key in GetAlby?

Derek Ross 2y ago

copy and paste it from wherever you keep it into Alby.

il_lost_ 2y ago

I also use for other profiles kollider and aka extension

Thanks Derek, I was wondering this exact thing. How do I do this on Android? You mentioned Nos2x and Kiwi Browser. Do I just download Kiwi Browser and install Nos2x within the browser somehow?

Derek Ross 2y ago

that works for browser clients, but not for native clients. there is an extension that's being developed now. i haven't tried it yet though. it's very new.

https://github.com/greenart7c3/Amber/releases/tag/v0.0.2

Derek Ross 2y ago

SORRY! *****there is an app that's being developed now that is not a browser extension

New to nostr and want to know. Does the act of simply of opening a brand new nostr account on one of these web based clients expose me to what you say above? I just starting using one of the web clients but haven’t even looked at my nsec let alone copied it (yet). Does that count?

Derek Ross 2y ago

technically, yes. if you generated your key / created a new account on one of these websites, then yes, your private key is stored in your web browser cache. hopefully nothing malicious is reading that cache, but there is always a chance for that to happen. one nostr client has cross site scripting attacks back in november or december. it's absolutely possible.

i'd recommend taking your key and using one of the extensions that i recommended. then clearing your browser cache to get your key out of your cache.

Thank you.

Excellent info

#Castillayleon

#Spain

#españa

#hispano

nostr:nevent1qqswee6xff42072tgh3cd3pjwz926t9pjeafkwj54h9se3ehwlt722qpp4mhxue69uhkummn9ekx7mqzyqlhwrt96wnkf2w9edgr4cfruchvwkv26q6asdhz4qg08pm6w3djgqcyqqqqqqgpwf9hv

Stuart Bowman 2y ago

Ok, because of this note, I just added an explicit warning on Satellite that you *really* shouldn't be copy/pasting your nsec and that you should use an extension instead... I still think it's nice to have the option for testing/tryout and for people who need to spin up an ephemeral "throwaway" id for whatever reason

Derek Ross 2y ago

That you Stuart 😉 You're a hell of a guy. Here are some freedom units.

Stuart Bowman 2y ago

Thanks mate!

Duncan Cary Palmer 2y ago

Thanks!

tforbanan 2y ago

Bro this is complete and utter bull security advice.

And the main reason why we all stuck here on nostr.

If you wanna entrust a kid the key to your house, the last thing you wanna do is lock it into a blackbox, tell 'im how important the key is that must never be lost, and you should never look directly at it either cause it melts in the sun.

No, what you do is to give em the key to the bikeshed or unimportant everyday use so they get a good grip on it and learn the pain of loosing a key as early as possible.

Cause that's how monkeys are trained.

Scaring people about lost keys and urging coolX wallet is how we ended up outsourcing our trust to subscriptions.

Point is, don't scare people, guide them to lose their keys and support through generation of new.

Best Advice ✌️