Nostr Web Client

Hey Nostr! We are MyNostr! A premium and affordable Nostr Address Provider By nostr:nprofile1qqs2sr7y57rrfm3x4272e9gmfn7hk44wrzat6v794lw0d0kkmjqwh5gpz4mhxue69uhk2er9dchxummnw3ezumrpdejqzyrhwden5te0dehhxarj9emkjmn9elawyf and nostr:nprofile1qqsx8x8ptc6pdhsf8wtregu8s0f2v65k2l9s3ja6fup9gmxa2km0rfqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduq36amnwvaz7tmjv4kxz7fwvf6kcmrfwd5xymm4de68jtnrdaksgepnk5 .

We have recently dropped our prices! With names as low as 5k sats! That’s less than your morning coffee!

You can get yours here instantly:

https://www.mynostr.com/

“Why should I have a Nostr Address?”

Reasons:

Increased profile authenticity, nip verified profiles look more legit.

Easier for people to find and tag you, it creates a human readable tag on your profile so you are found in search.

Prove it’s you: on Nostr usernames can be reused, opening the door to impersonation, only you can have your nostr address name though so your friends can tell it’s you and not an impersonator.

Lastly they look sick, and support plebs right here on Nostr!

Get yours now!

Show us your names below! Also repost this and reply, as well as follow us for a little something ⚡️ 😉

#bitcoin #Nostr #Plebchain #introductions

Valentino Giudice 6mo ago 💬 7

This is your daily reminder that NIP-05 addresses are not a form of verification and shouldn't be treated as such.

Please, see this: https://hedgedoc.semisol.dev/ciXY6QE-Tx6CQZowDwcK4A

Or this: nostr:naddr1qvzqqqr4gupzq5455pmtewaacws6a73hxkqkea6fjwcm3keq9vqu3q7930nl4k9aqyghwumn8ghj7mn0wd68ytnvv9hxgtcppemhxue69uhkummn9ekx7mp0qqfxu6tsxq6j66tn94hx7apdwejhy6txpdekay

Please, stop misleading users into thinking that NIP-05 addresses verify anything. They do not, they are not supposed to.

Clients should stop displaying checkmarks next to name accounts that happen to have an address and providers shouldn't imply they are verifiers.

nostr:nevent1qvzqqqqqqypzpnk6fktv0g09wqcp3ll37h8nlydck3c4n3pu3ncrlf7f057gs4gsqqs022hf2nxha5u43zt4ymqupr2pkdc5eyymt8stnhfl7qe6m9qasmssqz6cd

Reply to this note

Please Login to reply.

Discussion

daniele 6mo ago 💬 1

For this very reason some time ago I updated NIP-05 to clarify that it's not a verification:

Identification, not verification

The NIP-05 is not intended to verify a user, but only to identify them, for the purpose of facilitating the exchange of a contact or their search.

Exceptions are people who own (e.g., a company) or are connected (e.g., a project) to a well-known domain, who can exploit NIP-05 as an attestation of their relationship with it, and thus to the organization behind it, thereby gaining an element of trust

https://github.com/nostr-protocol/nips/blob/master/05.md#identification-not-verification

Unfortunately is impossible to identify these exceptions in a programmatic way, so I agree that checkmarks should be removed.

Valentino Giudice 6mo ago

Nice.

It really shouldn't need to be said, however (much less in the protocol).

Gigi 3mo ago

Hm. Interesting. Thanks for sharing!

Note Appreciator 3mo ago 💬 1

It’s really useful still for the reason you outlined. I see a domain I trust so I know the npub associated with it is trustworthy. When searching for accounts it is the only thing that I can use to tell me which accounts are real and which are imposter accounts if I don’t already have a web of trust. Either you do that or you have to have them tweet out their npub like some users did. Or just give you a npub irl or via a direct message on another trusted platform. Domains are everywhere and until there is a better way of doing this. I think the check marks should remain.

Valentino Giudice 3mo ago

It can make sense to trust an account based on its NIP-05 identity if you know the domain.

But the checkmark is shown besides the name of just any account that is associated with any domain name, trustworthy or not. Any scammer or spammer can trivially create a domain name and they are often very willing to pay. So the mere presence of a NIP-05 identity proves nothing.

A checkmark doesn't signal that the user needs to manually verify that the domain is one they trust. The message it conveys is that the account is to be trusted. And, again, the presence of a random domain is no evidence for this.

A solution could be to let users specify a pool of domain names that are to be trusted and have the checkmark for those domains.

The issue is that NIP-05 only allow each user to have one identity. So if there are two domains that could verify me, for instance because I belong to two organizations (many people do), I have to pick one and only one. The people who don't know the organization that I picked, but do trust the other, won't see a checkmark, even though they logically should.

Even for its intended purpose, NIP-05 should allow multiple identifiers. But verification is not its intended purpose.

Note Appreciator 3mo ago 💬 1

Ahh gotcha. I wasn’t thinking of those general providers that let anyone pay and then give the name. I don’t trust those at all because anyone can just make a famousName@generalProvider and get the check. The domain is what matters to me not the name. I was thinking more of the situation where I own my domain so I list my public key there so people know which pub key my domain has blessed. But I don’t bother with any of that when I’m posting from one of my many alts like this one.

Valentino Giudice 3mo ago

That's not even the only issue. What I was referring to is that anyone can pay a DNS registrar and have their very own domain name. And scammers create website with their own domain names very often, so the fact that they can isn't just hypothetical.

If someone creates a domain name and a NIP-05 identity with that domain name, clients will show a checkmark. Of course users can manually check that the domain name is a trusted one, but a checkmark conveys that the user is "verified", while the only thing that's been verified is that the owner of the account controls a domain name, which tells us nothing about trustworthiness.

daniele 3mo ago 💬 1

The multi domain thought is interesting.

You can technically create more NIP-05 addresses that are simultaneously valid; the pitfall is that currently clients show/verify only one NIP-05 from the "nip05" extra field.

To enable the multi NIP-05 support we could introduce duplicate "nip05" fields (but the JSON would be formally invalid), or have an additional "nip05_alts" with a list of comma separated secondary addresses.

Valentino Giudice 3mo ago

It's something I have suggested before, but didn't get traction.

I actually still think it should be implemented. JSONs must stay compliant. Other than that, I don't care much how the implementation happens, as long as it does.

One issue one might raise is performance. However, this is only a concern if clients load and verify NIP-05 identities for every account every time it's displayed. And the only real reason for doing so is the checkmark, which shouldn't be there anyways.

I think "verification" should happen, for all domains, when the user actually checks the info page of an account, which wouldn't actually require much.

daniele 3mo ago

> I see a domain I trust so I know the npub associated with it is trustworthy

As long the domain doesn't offer NIP-05 addresses.

In this case you cannot trust it, you need to verify the actual NIP-05, and pay attention to typos intended to impersonate someone.

Btw, NIP-05 utility exists for sure, as stated in the NIP: facilitate the exchange of a contact or their search.

Note Appreciator 3mo ago 💬 1

For sure. I remember a while back Jack used to have an @cashapp or block domain nip-5 and it made it easy to tell which Jack was the real one along with the guys who worked at cashapp

/block/square etc. on nostr.

The checkmark was useful because there were lots of other accounts at the time that would list the same nip-5 in their metadata but it wouldn’t show the check in most clients because their pubkey wasn’t in the domain’s well-known.

Now Jack doesn’t have a nip-5 anymore so you just have to tell by followers and previous posts now.

But yeah I never understood the get a nip-5 at randoNostrappDomain.com services… as if that meant something.

Valentino Giudice 3mo ago

Other clients would show the checkmark as long as the fake accounts are associated with some domain name. Users need to manually verify that the domain is the intended one.

> But yeah I never understood the get a nip-5 at randoNostrappDomain.com services… as if that meant something.

It's not *supposed* to mean anything.

Imagine meeting someone in person and wanting to get them to follow you on Nostr. You might not always carry an electronic device, you might not always have a piece of paper with your whole public key and you might not remember it by hart. Giving them something mnemonic, for the sole purpose of finding you, is easier.

Multiple addresses are important for several reasons. For example, some groups or institutions might give a NIP-05 address to member so that they can be found on Nostr by their name (like school email addresses, although it may not work well at that size). A person can belong to two groups or institutions and still wish to have only one account.