We need to transition away from direct private key login. It's not only insecure and bad for onboarding experience, but it is also a bottleneck to this protocols development.
The majority of the web ecosystem is declining because a large percentage of people either don't understand what extensions are or haven't set them up.
No one is building native apps because they know that no one will use the app's private key for login.
Soon, there could be a security exploit, and keys may be leaked, resulting in headlines like "Nostr got hacked," and that will always stay with nostr.
All major clients must reach a consensus to establish a standard for disposable secondary keys.
How is this not a priority?
Replies (11)
we need a mobile wallet connect solution, like walletconnect is for dapps
nostr:nevent1yl6n0zz2ltz6m67ge4mpxf45jvvdwgtt4k2t2n6cf5xszaxas9ks3gwvu7
People harping on giving up control for the sake of adoption should be asked one question? Why do they want adoption so bad? Isn’t the right way eventually going to win?? What is their motive?
Exactly.
I’m a savvy idiot. I use extensions for desktop understanding the trust I give to the extension.
I use Damus exclusively for mobile understanding that I have given away my nsec for better or worse.
I’m obviously not a dev but this is base layer security and seems to be overlooked.
It seems like Spring is going in the right direction or am I wrong?
This is not a priority because apparently some are more focused on things like building contract management systems or reinventing website hosting on top of nostr, instead of fixing real problems that the protocol is currently battling with.
It's all about trying to get a group of devs that know precisely *what* Nostr lacks in order to succeed. Since currently we're at a point in which most devs are basically going in their own direction, instead of focusing on the real issues at hand.
I don't know... Could also work the other way around - exposing the fact that it's the end devices that are always most security fragile and by making stuff uncensorable via protocols like #nostr, it forces them privacy invading and censorhip mongering fuckers to approach per-individual approach, which is completely unscalable, at least not scalable without a significant risk of yet another "whistleblower leak".
Also, people don't learn any other way than pain...
IMO disposable secondary keys = maybe not a bad idea, HOWEVER, would likely introduce complexities inviting attack surfaces to emerge...
Just like with #Bitcoin, not your keyes, not your data...
IF/when such a solution is introduced, though, it better have a good security/convenience balance... there's ALWAYS a tradeoff.
These days, the tradeoff is that you MUST trust the end device in case you're using direct private key login. And with all the backdoors in pretty much everything in place, you know there's no easy solution to this...
I vote for self/shared-hostin collections of clients due different use cases. and hardware key login.
corporate client hosts could enable lightning login perhaps. though I've not successfully logged into anything without providing and email with a LN login.. don't kyc me bro
No mainstream adoption without keychain / FaceID integration
Dan I mostly agree. Also: Passkeys exist now on all major platforms now. That was not true a year ago. That must surely help a Lot!
(They are stored locally , and apple cannot decrypt the keychain that shares them to your other apple devices. on iOS. Same for Android 14, as of 2 days ago. )
Also, the Zion (app) now exists. Which is very well designed for the specific decentralized ID requirement
🤷🏻♀️
