Auth and privacy
Sometimes I see devs advocating for auth as a privacy feature. It isn’t. In fact, is the opposite, authentication means that the user must be identified and verified.
As far as I know, the only way to achieve privacy preserving auth is through blinded authentication schemes, which is not what we have in Nostr. NIP-42 involves the relay challenging you with an event that you must satisfy with a valid signature. This proves that you are the person controlling the key. This means, a log of this user requested this event at this time, and of course if you don't use a VPN or tor, this also involves your ip.
We could argue that users can use throwaway or ephemeral keys, but that doesn’t mean authentication itself provides privacy.
The next time you hear someone say that auth equals privacy, member this, it doesn’t.
Replies (9)
Yea, if it is your relay, there is no issue, but to understand the nuances of that an user needs a degree on nostr and stuff, and nobody really cares. Not even devs nor the nips kabbala
Sure auth guarantees the user, but relays can likely, pretty easily infer the user based on their req patterns, especially from known clients. Unfortunately, I think we have to entrust relays with our feed and location privacy, which is why I'm so against outbox client model.
when #NDN , mfers, already.
Well, right, but so far, if you need to verify it with a challenge, an irrevocable proof that it was you and no one else, anyone can build a filter that looks like you, but no one can fake your real signature. And I agree, the outbox model is pretty bad in this regard, the same or even worse than Facebook Pixels, xD.
XD True, but Pixels are pretty easily mitigated in browsers and even firewalls, outbox can't it MUST bypass those protections in order to function. So yeah id consider it has possibility for more damage than a pixel does. Ugh, imagine if we still use outbox and companies figure that out XD
Im sure the NSA has at least one relay the majority of nostr users are connected to right now sharing their location and habits with.
I think best is to use a smart relay that does outbox for you. Optionally give it a key to use with auth, to signup for additional services and higher publishing rates, give it a VPN.. Then connect to that with one connection..
Its better, faster, stronger and still decentralized..
Relays are apps too. 🌴
Indeed
Nice. Can they kickflip?
Privacy is the new marketing term to get you to read.
