Nostr Web Client

Replying to

El Flaco

#[6] is maintaining amethyst

Nicolas Burtey 2y ago

Can we do a PR to add #[2] #[5] ?

Replying to

calle

Zapped you, didn't BRR the zap counter :(

Nicolas Burtey 2y ago

To bbw

seems we have still some debugging to do

Replying to

pid 👨‍💻

Zapped you using zeus, but it didn't increase the counter it seems (maybe because zeus?).

Also when amethyst opens the 'select a wallet' screen to zap it shows 7 other installed apps but not bbw for me (also installed). Not sure if the second one is on amethyst or on the bbw app?

Nicolas Burtey 2y ago

I think it’s in amethyst. It’s present in #[4] for instance.

Who’s the developer of amethyst?

Nicolas Burtey 2y ago

now I see ostrich everywhere

https://void.cat/d/X8TRZRgDuznAjW1ZZchJDp.webp

Replying to

Luxas

Let's talk #phishing on #nostr

The art of the catch is in being as deceitful as possible and mimicking something familiar that your target takes the bait.

Nostr clients (at least the web ones) allow you to login to someone else's account as read-only mode.

You can see their notifications and even see who has messaged them. It's even possible to know who the target replied back to, as standard message bubbles give it away.

https://imgur.com/a/uraDw64

Of course, the contents of messages cannot be read, as they're encrypted.

But, if you're farming for victims to pwn, and you see they DM'd an "influencer", it'd be easy to create a clone account of the influencer, register a near-match domain, get it NIP-05'd and then send your targets a DM.

I'd venture to guess not many (at least not many of the technologically inept) would take the time to validate the pubkey.

It would be great if there could be some sort of secondary auth for viewing notifications/messages when in read-only mode. Not the privkey, but a password or something else only the account owner would know.

This way, the account can remain in read-only mode without the ability to sign messages, but the things that should remain private, stay private and less susceptible to being used as phish bait.

As the saying goes, "trust, but verify". Stay vigilant #nostriches and ensure whoever DMs or replies to you is really who you think it is. There will always be malicious actors, but you can prep to combat them!

Nicolas Burtey 2y ago

Inretesting how the fact metadata on PM between are people are visible for everyone make Nostr a platform where phishing will be even be more effective than on Twitter

Does PM even make sense if there is no p2p component?

Nicolas Burtey 2y ago

Zap from #[0] should really work now 😂

Give it a try!

Replying to

Derek Ross

I sent 1,000 sats, but I do not see it working. 😟 Back to development you go!

Nicolas Burtey 2y ago

Should work now. We didn’t had the pubkey in lowercase

Only BBW <> BBW are not yet reported

Replying to

Ernesto

Testing, testing send me some sats.

Nicolas Burtey 2y ago

You don’t have any lightning address to your profile

Replying to

Gigi

Now that zaps are taking off and more folks experience the power of V4V first-hand, I'm tempted to write more about it (and share some thoughts on how to do text-based V4V "right" - or at least not terribly wrong!)

What do you guys think I should focus on?

Here's my writing on it so far: