🛡️🔐 GM, Nostr! Nostrich will soon support Google login, making it easier for people who have never used Nostr to get started with a single tap. We're building it on Pomegranate, an open standard for Google login on Nostr. Your private key is managed using FROST threshold signatures, with key shares distributed across independent operators. Google never sees your private key, and Nostrich never stores it. Under the hood, Google login uses a standard NIP-46 remote signer. This means if you sign in with Google on another Nostr app that supports Pomegranate, you can use the same Nostr identity on Nostrich, and vice versa. The goal is simple: lower the barrier to entry without compromising decentralization. With this implementation, we're targeting people who have never used Nostr before. All existing sign-in options will remain unchanged, and users signing in with Google will receive reminders about the importance of owning and backing up their private keys.

Replies (32)

Gm!I understand the goal of making Nostr easier to access, but I’m a bit skeptical about using Google as the entry point. If people get used to logging into Nostr with Google, they may never learn the importance of actually owning their keys. Decentralization should mean more than just hiding the complexity behind a Google account. The crucial question is: Can a user completely recover and use their Nostr identity if Google disappears or blocks their account?
You don't help people stepping out by helping them stepping in. Here I am clibing the learning curve for a reason. Yet, strategically, it just, barely just might work in the long term. But I suspect not.
If I may say so, please stop working on new features and focus your efforts on the stability and speed of your app, which is currently clearly unusable on iOS.
Shadow Force's avatar
Shadow Force 1 week ago
conflicted on this one. one question - let's say someone sets up using your google auth because it's easier, then progresses and wants to use keys and get rid of google. Possible?
Pomegranate is not Google-specific. I think it shouldn't be marketed that way; that confuses everyone. See number 3.
fiatjaf's avatar fiatjaf
People making new apps, why aren't you adding Pomegranate support? 1) I didn't know it existed (now you know); 2) I think it has a fatal flaw (please say what is it); 3) I am phisophically opposed to Google (Pomegranate supports other providers, and even no providers at all, it can even be made to support phone numbers, a single password, an email, a set of friends' keys, you name it, but none of that is active yet because there is not enough interest); 4) I think users have to be trained to type private keys everywhere; 5) I like Amber (I've heard this one before so I included it here even though it makes no sense). View quoted note →
View quoted note →
I honestly don't like the idea at all and feel this sacrifices privacy for people who choose this option. I joined because I want some privacy aside from a platform that is basically impossible to shutdown. If people use this their identity can be tied to their npub I feel
Lucas Vital's avatar
Lucas Vital 1 week ago
Quero ser interessante se o pessoal do Bitcoin colocar suporte para rede do reticulum network #Bitcoin #reticulumnetwork
I always advocate for multi-layered authentication in computing systems. There is a fundamental technical distinction between two-step verification (2SV) and true two-factor authentication (2FA). With typical 2SV, the service provider retains control over the tooling and verification channels (such as SMS or app prompts). In contrast, standards-compliant 2FA, such as FIDO2 hardware keys (YubiKeys, Google Titan) and OpenPGP smartcards, ensures private cryptographic keys never leave the Secure Element, aligning directly with industry security and ISO standards.
↑