NOSTR 🔥
Just wanted to surface a privacy concern some of us have been digging into: timing analysis attacks on encrypted DMs in Nostr. Even though the messages are encrypted (NIP-04), observers watching a relay can correlate senders and receivers just by looking at when messages are sent and received.
This kind of metadata leakage might sound minor, but it could be serious especially when traffic is low or when people rely on only a few relays. Timing patterns can reveal communication pairs, undermining the privacy Nostr aims to provide.
Some ideas have been discussed (delays, batching, cover traffic, NIP-59), but I’d love to hear more perspectives.
How big a deal do you think this is? Any mitigation strategies you’ve seen or implemented?
