Nostr Web Client

User @npub1667rw28lg8jtc2fk27zfys92k24l503avk6laetdkfzdaaxm833q392m5j was seen connecting to #Nostr in the past day with IP 122.219.108.140. https://iplocation.io/ip/122.219.108.140 #NostrExposedIPs

Ostrich McAwesome 1y ago

User @npub1dg9cl3ztaga3lk524v3qjrujhvfc0dvdu3p6ckmkpkmsq6l7dtwqzvyq97 was seen connecting to #Nostr in the past day with IP 57.128.96.115. https://iplocation.io/ip/57.128.96.115 #NostrExposedIPs

Ostrich McAwesome 1y ago

User @npub1lc6c4ukssmuf678py7k6thmlk8c4a52l9zx4thec48ve2qmcdqys22jt95 was seen connecting to #Nostr in the past day with IP 177.100.51.7. https://iplocation.io/ip/177.100.51.7 #NostrExposedIPs

Ostrich McAwesome 1y ago

User @npub1ckem6dmxpup7sl9lnw05ku9g9ke9nm3pzl2dyz3kkjgk55wpvjeqz5zdds was seen connecting to #Nostr in the past day with IP 104.28.32.197. https://iplocation.io/ip/104.28.32.197 #NostrExposedIPs

Ostrich McAwesome 1y ago

User @npub140z7gqmyr0dtg26csgddd6c59zv4ynnc5ywwuuth7ktrupgwdgfqlla6hl was seen connecting to #Nostr in the past day with IP 88.239.94.215. https://iplocation.io/ip/88.239.94.215 #NostrExposedIPs

Ostrich McAwesome 1y ago

User @npub1kjqas5aa64yu3jk33hxplv0u3kaxa94kqfu0empc3wc4jeletgks8hwfnv was seen connecting to #Nostr in the past day with IP 104.28.114.0. https://iplocation.io/ip/104.28.114.0 #NostrExposedIPs

Replying to

Enki

So this is not a fix, More of a Band-Aid. But if you're using the #amethyst client, you can turn off automatic image rendering and link previews.

I genraly keep this off on most of my apps specifically because of issues like the IP leaker thats DMing people.

There have been instances in other programs such as Telegram where automatically downloading a malicious image can compromise your account.

Ostrich McAwesome 1y ago

Do this. Reduce your attack surface. You'll get to see what the image URL looks like before you load it, which means mine should be obviously no good. You'll be quizzed on this later 😜

nostr:nevent1qqsqwcvqfd97js4hywjqwmkdwg5a8jgpz3tgmxh9q0f0cev7j9eu83qppamhxue69uhk2tnwdaejumr0dspzq3xurskmnslm67lwjft7e66jhc7033qt4aak8arw266c5ycuwnctqvzqqqqqqym6lq0x

Replying to

Ostrich McAwesome

Happy to give some choice privacy advice to someone who clearly understands what I'm doing.

1) Get an anonymous Internet connection (if you can). In the US you can get an unlimited, unthrottled 5G hotspot for $500/year from The Calyx Institute, which is both a good deal and helps support digital freedom. You can register anonymously, pay with Bitcoin, and have the hotspot shipped to a FedEx pickup point so you don't have to give up your address. It will still reveal your rough geographic location by IP, but nobody is socially engineering your name from the carrier. Outside of the US you can often buy data SIMs with cash, which have similar advantages. The upper-tier 5G hotspot from Calyx has an Ethernet port and built-in OpenVPN capabilities, so you have some serious options with the right equipment.

2) Use a VPN whenever you can. Not just an app on your device, consider getting a router that supports VPN client mode (or just install OpenWRT), and use a VPN like Mullvad to route your whole home network through a tunnel. Stop using Google and Apple VPNs, who do you think you're protecting yourself from! Use different VPNs/Exits for different purposes.

2a) Stack privacy. You can route a VPN over a VPN. You can connect to Tor over that too. Performance takes a hit, but that's a small cost for multi-tiered anonymity.

3) Separate sensitive tasks between your devices. Some things in life are more private than others, so make sure you know what to trust. Your Facebook app shouldn't be on the same device as a Bitcoin wallet, or at least not on the same user profile. Keep multiple phone and PC logins for different purposes. Keep multiple networks for your devices, and route them through different VPNs. Have a laptop just for Bitcoin. Have a laptop just for porn. Laptops and android devices are cheap, compartmentalize your digital life for privacy and safety.

4) Avoid corporations wherever you can. Use ProtonMail instead of Gmail. Use Linux instead of Windows or Mac. De-Google your phone with LineageOS or CalyxOS, and start taking app hygiene seriously. Use FOSS alternatives whenever you can, even if you like the proprietary version better.

5) Never self-host at home unless you have a dedicated ISP and network for it. It's a ton of fun as a hobbyist, but it's not good for privacy. Never let your home become an attack surface. Find a smaller cloud provider that accepts Bitcoin and rent resources pseudonymously where you need them, or go hardcore and host your own ASN out of a small rack somewhere.

5a) Furthermore, know your rights when registering domains. For example, you may feel patriotic buying a .US domain, but it is trivial to retrieve your full whois contact info from .US domains, and they will more aggressively enforce a real address requirement.

6) Never trust bleeding-edge tech. New technology is exciting, but it's full of bugs and mistakes. The newest version of something is often the worst version of it. When the web3 hype machine tells you that Nostr is the future of private social media, don't take their word for it, look for the evidence. If there isn't any, proceed with caution.

7) Embrace a zero-trust philosophy. Every actor is a potential bad actor, so build a moat. Don't get mad if you get pwn'd, black hats and gray hats (howdy) will target you, so be prepared for it, and learn everything you can from your mistakes and the mistakes of others.

Ostrich McAwesome 1y ago

I forgot:

4a) Dump all the IoT devices like Alexa, Google Home, Chromecast, etc. and find solutions to automate your home with FOSS (which interferes somewhat with the convenience factor), or just accept that the current state of home automation requires an unacceptable forfeiture of privacy and flip your own damn light switches.

Ostrich McAwesome 1y ago

This is the way.

Replying to

ภ๏รtг๏ภคยt

After careful consideration.....

I think I'm on nostr:npub1wq6n8skpdtrhw8hmr00kp2za7a8y97zqngq8jq85q2aydp8ejxzq8p7d9k side of the table and applaud his/her actions

The reality is these people with IPs exposed are talking about internet security and privacy, actually imo, something more important, bitcoin security and privacy, but not even following their own advice....

He's just throwing it in your face and exposing REALITY.

Brah. Keep up the good work and expose all these fakes trying to teach folks like me something.

👏 👏 👏 👏

Actually, fuck them. You wanna teach me some shit homie and about internet security/ privacy?

I'm all ears.