Thread - Nostr Hypermedia

Vitor Pamplona _@vitorpamplona.com 2 years ago

> Just better encryption that does not increase the chance of nsec leakage? Correct. NIP-44 is not a new DM NIP (that will be another number). NIP-44 just defines a better encryption scheme that any other NIP (including a DM NIP) can use. The offered protections by NIP-44 are against the needs of that individual encryption and not against the needs of a new DM system :) In other words, you can definitely use NIP-44 in a way that is not private at all. The encrypted parts will be private, but all the other markers in the event can give everything away. It's like citing somebody in a NIP-04 message and adding a p-tag to that person outside the encrypted component.

↑ Parent

Replies (2)

Shawn 2 years ago

Thank you SO much for this explanation! I want to start up a private relay and I’ve been really concerned about the “best” way to implement E2EE DMs. Looking forward to reading the next DM NIP that implements this.

1 replies ↓

Vitor Pamplona _@vitorpamplona.com 2 years ago

This is the new DM I am working on:

GitHub

NIP-17 (old 24) Sealed Gift-Wrapped Messages for Private DMs and Small Group Chats by vitorpamplona · Pull Request #686 · nostr-protocol/nips

This PR creates a new private messaging scheme from the learnings of many past proposals, including NIP-44, NIP-59, NIP-24, NIP-103, NIP-76. It bri...

and it is available on Amethyst right now. It tries to be as private as possible without having to have an AUTHed relay. I would argue that in extreme privacy implementations it could be more private than SimpleX. A client can have a DVM to connect to receiving relays for users and not leak your device's IP that would allow for some correlation even if everything is encrypted. @Mazin has a very good start with inbox.nostr.wine. The way to see the relay is as a mail box for the user. The user is paying for the relay to receive and store any event that `p`-tags the user. They might be spam or real messages. It's not the relay's job to decide which is which. It's the user's job (via a good client that helps you manage your inbox) to delete things that are spam and clean up their account with the relay from time to time.

1 replies ↓