20 sats \ 8 replies \ @siggy47 24 Dec 2022 \ on: Nostr will Decentralize the web? : Pippellia's Twitter Thread nostr
The thread has valid criticism of nostr. I have already realized that if I plan on using nostr long term I will need to assume a number of identities. Right now there is no way to secure your private key without enduring the inconvenience of copy/pasting it to sign every interaction. Some people are using alby, but then you are trusting alby. I have experimented with my password manager, but it's still cumbersome and again, I need to trust my password manager. That's a scary proposition considering the Last Pass disaster. I am still optimistic that the smart developers involved with nostr may come up with better solutions in time.
write
preview
30 sats \ 5 replies \ @gandlaf21 24 Dec 2022
I agree... in my opinion, signing has to be done outside of the clients. I imagine something like an API on the device, where you can store your keys in a secure enclave, send in the information or message that needs to be signed through said api, and the api returns the signature. this way clients could call the device's api to sign messages, and don't need to store private keys themselves.
reply
20 sats \ 1 reply \ @gandlaf21 24 Dec 2022
https://developer.apple.com/documentation/security/certificate_key_and_trust_services/keys/protecting_keys_with_the_secure_enclave?language=objc
something like this.
reply
0 sats \ 0 replies \ @siggy47 24 Dec 2022
Yes, perhaps with a way of using an existing private key to avoid having to start over.
reply
10 sats \ 2 replies \ @siggy47 24 Dec 2022
Good point. That makes sense regarding the signing issue. The thread also discusses the real problem that security erodes as you use the same public key continuously.
reply
20 sats \ 1 reply \ @gandlaf21 24 Dec 2022
Yes, key rotation in general. Also, what happens if the Private Key DOES get compromised? There won't be a password reset button, that's for sure.
reply
0 sats \ 0 replies \ @siggy47 24 Dec 2022
I think mine has already been compromised. I don't really care, since I'm keeping no sats in my wallet and I'm just playing around with a throw away identity right now as I experiment. Things will be different when I am ready to set up a permanent presence. I'm still toying with different ideas on security.
reply
20 sats \ 1 reply \ @blockguard 25 Dec 2022
Maybe same kind of device like a hardware wallet? Or yubikey?
And of course user should always have a duplicate signing device.
It really is no different to your house or car Keys.
reply
0 sats \ 0 replies \ @siggy47 25 Dec 2022
I'm sure things will head in that direction. Of course,.when you're hodling bitcoin you need to use your wallet at most maybe inve a day. It will be impractical to access every time you like a post or respond to a dm. Also, using the same public key over time will erode your privacy in the natural course of interacting with your followers. I guess that is the nature of social media and shouldn't be considered a problem.
reply