pull down to refresh

130 sats \ 14 replies \ @k00b 4h \ parent \ on: Official Coinos Guide meta
in what ways am I giving SN the ability to spend my money: when you have SN's website loaded, your wallet is decrypted, and your browser is connected to the internet, SN's clientside code has the ability to spend your money from your browser.
in what ways am I NOT giving SN the ability to spend my money: when SN's website is NOT loaded in your browser or your wallet is NOT decrypted or your browser is NOT connected to the internet, SN cannot spend your money.
in what ways WOULD I be giving SN the ability to spend my money IF SN did this differently: SN, or anyone who gained access to SN's database, would be able to spend your money at will, at anytime.
write
preview
1888 sats \ 2 replies \ @k00b 4h
It may seem like we're punishing ourselves by being paranoid and doing something that may only sound marginally safer, but we think it's more than marginally safer and worth the pain -- assuming we can smooth out the UX.
Further, establishing the precedent and expertise around not storing any sensitive customer data on the servers will afford us great agility when doing things like end-to-end encrypted DMs (which we see as critical to providing marketplace and private chat/community features worthy of bitcoiners).
reply
50 sats \ 1 reply \ @SimpleStacker 1h
reply
0 sats \ 0 replies \ @ek OP 27m
Also, no nostr client is using NWC to receive, they all use lightning addresses afaik
Ask yourself why
reply
10 sats \ 1 reply \ @DP0604 2h
Hey, I didn't know this. I recently started using Coinos, is one of the wallets I used as a beginner to start my journey with Bitcoin.
reply
0 sats \ 0 replies \ @k00b 1h
It's a great place to start!
reply
0 sats \ 8 replies \ @SatSquares 15m
Where exactly on the browser is the decrypted wallet stored? And does this mean our NWC is encrypted and living on your database?
reply
21 sats \ 7 replies \ @ek OP 14m
In memory
reply
0 sats \ 6 replies \ @SatSquares 12m
Got it. But then where's it come from / get hydrated? Does that mean it's living encrypted on your DB?
reply
0 sats \ 5 replies \ @ek OP 12m
Yes, that’s how you have access to it on all devices and have to enter the same passphrase on all of them (we have plans to make this not necessary) and how we (or an attacker) don’t have access to it because we can’t decrypt it.
reply
100 sats \ 0 replies \ @SatSquares 9m
Ahhh, the passphrase decrypts it. THANK YOU!
reply
0 sats \ 3 replies \ @SatSquares 9m
And I guess last question because I have a severe misunderstanding:
in what ways am I NOT giving SN the ability to spend my money: when SN's website is NOT loaded in your browser or your wallet is NOT decrypted or your browser is NOT connected to the internet, SN cannot spend your money.
The encryption key must live somewhere so can't SN decrypt said NWC and spend money that way? Or do I severely misunderstand NWC
reply
0 sats \ 2 replies \ @ek OP 8m
That key is generated on your device and never leaves it. It is stored in IndexedDB as non-extractable.
reply
100 sats \ 1 reply \ @SatSquares 7m
Super cool. stuff. I learned a lot through this exchange. Thanks a lot!
reply
0 sats \ 0 replies \ @ek OP 6m
No worries, more people should understand that we’re not shooting ourselves in the foot for no reason
But most people are high on custodial stuff haha
reply on another page