The key detail you might be missing is that NostrPass executes in a Worker, not in the main page context. So in NOstrpass it goes client -> vault -> worker. The worker has it's own context and isn't callable from the extension.

I like the Idea of OPFS for sure, context is what matters.

It's kinda insane that we've built the incentive structures of business in a way that are designed to fuck over the user/consumer.

How nice would it be if you could just trust a company to do the right things, and is not gonna extract and sell every last drop of data from you?

I might even consider running non-opensource software.

But in this precedent, no way.

you have to assume they are trying to fuck you.

A sad symptom of fiat money, or how did we end up here?

I’m trying to wrap my head around the differences between using IndexedDB, OPFS, and SQLite in your scenario. I’ve been researching the idea of running an isolated iFrame on client.com for vault.com and passing data between the two origins via postMessage. In that setup, is there anything in NostrPass that prevents rogue extension