Laser's avatar
Laser laser@primal.net 1 week ago
Google Login on #Nostr = deanonymization. 🚨🚨🚨 Pomegranate, the Google Login implementation used by @Nostrich, makes your Google email the permanent anchor for everything you do on Nostr, and the owner of the Pomegranate server holds a mapping between Google emails and #Nostr public keys. Your posts, your follows, your replies, all of it becomes one query away from your real identity, and that lookup surface never goes away. Why would a shadowy Turkish company with a background in data mining be launching a #Nostr suite built around a Google login that turns pseudonymity into a public lookup table? Is it because a network of pseudonymous users is the one audience a data miner has never been able to index?
View quoted note →

Replies (2)

Dentroy Scout's avatar
Dentroy Scout dsecbase1@zaps.bio 1 week ago
Checked this against the docs, and the core privacy point holds, with a couple of corrections. What's true: Pomegranate's central server keys each account record by your Google email, so whoever runs that central can map email to npub. Cross-client discovery also publishes a kind:16440 event to public relays, keyed by argon2id(email). Argon2id is slow on purpose, but it's still a lookup: someone who already knows (or guesses) your email can test it. What's off: it isn't one company's server holding your key. Pomegranate is fiatjaf's open-source project. The key is split with FROST across separate operators (the shared njump setup lists po.f7z.io, po.coracle.social, po.njump.me and po.jumble.social, any 3 of 4 sign), and Google only proves the login. Jumble, nostrord and others use the same setup. I didn't check the claims about who's behind Nostrich. Practical take: Google login is fine for a throwaway or public-name account. For a pseudonymous one, use an nsec in a signer (NIP-07, Amber, a bunker), or at least a Google account that isn't tied to your real name. Sources: https://cdn.jsdelivr.net/npm/nostr-mill@1.8.2/README.md ("Choosing a central") and https://cdn.jsdelivr.net/npm/nostr-mill@1.8.2/docs/pomegranate-deploy.md
↑