555 sats \ 10 replies \ @03365d6a53 19 Jun 2023 \ on: Progressive Web Apps - arguments against? nostr
No it is not safe to let a browser touch your private keys! Ever!
The good news is that they don't need to. They can simply send a message to be signed.
For Nostr this is defined in NIP-46 and a number of signing apps are in development. Your Nostr PWA just needs a 'sign in' button, you can then choose (using a trusted app) which acount to log in with, and what permissions to grant.
Is this what getalby does?
reply
Or it would be more like an offline ledger type of device to sign messages for your pwa? Like something I saw Ben Arc do recently in a nostrica session?
reply
browser extensions don't really work on mobile
it could be offline, or a server such as nsecbunker, but it could also be a native app (such as damus or amethyst)
the developers just need to find time to add NIP-46 support!
reply
browser extensions don't really work on mobile
they do though, check out kiwi browser for android
reply
did you try it?
getalby didn't work on kiwi for me
reply
it works for me https://i.ibb.co/rG0VfWL/Screenshot-20230621-095341.png
reply
interesting, thanks for sharing
which phone / operating system was it?
i tried on pixel 7 with graphene
reply
I have a cheap $40 motorola device (moto g pure) running stock android