Nostr Web Client

**Security Update**

I've got some bad news for you guys. This morning, as I was adding error handling to flotilla, I discovered that Coracle has been sending user session objects to bugsnag when reporting errors.

Who is affected: Users who triggered an error in Coracle while signed in with their private key, since December 5th 2023.

What I've done:

- I immediately released a new version of Coracle, both to web and to zap.store

- I have deleted the affected apks from my releases

- I have deleted all my error data from bugsnag

- I have deleted my bugsnag project and rotated my api key, so lingering error reports will be dropped

- I have audited my code for use of the session object to ensure nothing else like this is happening

What you should do:

- If you're logged in with your private key, log out

- Hard refresh the page to ensure you have the latest version of Coracle

The bottom line is that if you signed in to Coracle with your private key, it has been shared with me and with bugsnag. In practical terms, your keys should still be secure, since they were sent over TLS, and have been deleted. But there is no guarantee I can offer that they are in fact gone.

I take my users' privacy seriously. My error reporting implementation doesn't record user IPs, it redacts identifying data, and it allows users to opt-out. I also warn the user when they attempt to enter an nsec into a text field. In this case, I simply screwed up, and I sincerely apologize. Reply to this note if you have any questions.

Vveerrgg 1y ago

Thank you for the transparency & if anything else … a nice reminder that private keys need to be kept private.

Secondary question. Can ppl rotate their nsec? And generate new private public key to a Nostr account? #askNostr

Reply to this note

Please Login to reply.

Discussion

hodlbod 1y ago

There's no standard way to do it, but lots of people have success with social key rotation. Just make a new key and tell your follows you've moved. I'm sure we'll eventually come up with something more streamlined.

Braydon Fuller 1y ago

Indeed, I've been thinking about how to achieve that. It should be fairly simple.

I see it in two parallel goals:

1. Ability to revoke a key. This will inform followers that a key can not be trusted anymore. This will not include any suggestion of the next key. As it has been compromised it would be useless anways.

2. Ability to confirm an identity through a social graph (e.g. people you know can help to verify that a profile is the authentic one). This will be useful for completely new users, as well as a user that has had a compromised key.