Avatar
xtogro
48b50e45c1a049ab5ba0eab4381f0a3b6b21d09aaaa1aea6b1e2daf27ebdd7ab
tech. transparency. entropy.
Replying to Avatar ChipTuner

Yeah this is something I care deeply about. I'm pretty paranoid when it comes to this stuff, which is why I build a tool I call NVault, it puts my nsec behind multiple layers without the code to extract it, ever. I think nvault is a pretty ideal solution for paranoid desktop users for the isolation benefits. Only remote signers can help mobile users and that has it's costs too.

That said, I'm not a mobile developer, but to me, having an nsec on a mobile device is identical to a hot bitcoin wallet. Often apps will store the nsec with symmetric encryption derived from a password, however this still requires the nsec be available in memory and accessible within the same process's memory space. I'm not usually concerned with keys at rest on modern mobile devices with asymmetric encryption. It's what can happen when the nsec is available in plaintext in the applications memory space.

So yes when the nsec is local to an app, I think you should have slightly higher concerns. However generally speaking it's more likely that keys will leak based on user error or phishing than though an application flaw, at least in the short term. For example, copy/paste to another app and you forget to clear your clipboard, or you accidentally pasted in a form or something like that. With browser clients they can be open to XSS attacks that can also leak keys. The handwoven part is that well it's secure as any other key or password you likely already use.

Also feel free tag me any time you maybe have questions like this I could probably answer more in depth, because most of these apps are open source

https://github.com/vnuge/nvault

interesting that you brought up the hot wallet analogy because one of my questions is:

what’s the equivalent of a cold wallet for nostr?

i see nvault moving things forward here, but i’m still thinking about broader adoption.

imagining millions of users spread across a bunch of dominant clients. when there’s a massive leak of credentials in centralized systems, it’s somewhat manageable, but with nostr… that could be a protocol killer with no way to fix things.

but — just to confirm, clients don’t store nsecs outside of the device, correct? if not, then it makes sense that phishing or user errors are the bigger risks.

thank you!

usually, #asknostr and #introductions spark a lot of engagement, but not so much on this topic.

anyone willing to dive into how client apps store nsec keys? what are the risks of large-scale leaks, and how do we minimize them?

hundreds of cryptocurrencies exist, and i get why bitcoin (first mover, broad adoption) but why is monero? i’m genuinely curious.

very early gm 🥱

after a few days, i get the sense there are basically two camps here: monero and bitcoinero. right?

> new with timeless understanding

i think that’s nostr.

i’m thinking about the first part, but, for a few days, i’m cracking my brain to find some analogies (“the old”) from other disciplines to what i see here on nostr. today’s concept of “feed marketplace” or nostr:npub1v5ufyh4lkeslgxxcclg8f0hzazhaw7rsrhvfquxzm2fk64c72hps45n0v5 integration with nostr are just so unique.

today’s social media for obvious reasons (ad impressions) are like a crowded pub or speed dating. many faces, snap moments, next table, next scroll.

this changes though. concepts like substack and nostr’s nostr:npub1w0rthyjyp2f5gful0gm2500pwyxfrx93a85289xdz0sd6hyef33sh2cu4x or nostr:npub1v5ufyh4lkeslgxxcclg8f0hzazhaw7rsrhvfquxzm2fk64c72hps45n0v5 seem to introduce a more content-centric approach, where a conversation is on top of higher-quality consumption.

it feels more like reading a book in a park and meeting some friends passing you from time to time.

yeah, you’re right. but i think by the chart distribution it must have been, idk, around… 58k respondents? more or less, but i’m pretty sure somewhere in that range!

to take it further:

“each time history repeats itself, cost goes up” ~ r. wright