Thread

Zero-JS Hypermedia Browser

Relays: 5
Replies: 22
Generated: 20:52:05
GM Nostr ICYMI: if you have someone’s new Wallet of Satoshi lightning address, you can look up all of their payments on Spark's transaction explorer 1) Request an invoice using the Lightning address 2) Paste the bolt11 invoice into https://lightningdecoder.com 3) Scroll down to the 'Routing Info' entries, and copy the pubkey with the highest CLTV Expiry Delta 4) Paste that address into https://www.sparkscan.io/?network=mainnet Alternatively, use this tool that nostr:npub1u8lnhlw5usp3t9vmpz60ejpyt649z33hu82wc2hpv6m5xdqmuxhs46turz made here: https://github.com/benthecarman/spark-invoice-doxxer As far as I can tell, this is not a strict requirement for Spark lightning address implementations, so I hope to see this change. At present, if you give someone your Spark address or node pubkey they *can* access your transaction history. Nonetheless, really disappointed to see WoS leave the USA only to return with something that has zero privacy. We can do better.
2025-10-09 11:18:14 from 1 relay(s) 14 replies ↓
Login to reply

Replies (22)

Would be great to summarize your conversation with nostr:npub1ey6qdmvzcgcsr883m9nspzz0mm037l26xtardzcskfsvc6gc7jssm9szvp on Xitter in this thread. My understanding is nostr:npub1jugar2agq6369p0l86razavs9shj2p6pscxecevs8j94ap37hkqsjlfc28 has managed to solve these privacy leaks in ways that nostr:npub1hcwcj72tlyk7thtyc8nq763vwrq5p2avnyeyrrlwxrzuvdl7j3usj4h9rq hasn’t.
2025-10-10 12:33:28 from 1 relay(s) ↑ Parent Reply
I emailed them too (also spoke to Aaron) and was told that they had left the Spark address exposed in the public .well-known/lnurlp string for testing purposes and it was only removed right before the public release. He didn’t follow up when I tried to dig deeper on the invoice question.
2025-10-10 12:37:10 from 1 relay(s) ↑ Parent Reply
The default behavior in the Breez SDK is not to expose the spark address in the bolt11, so you can't do what Evan showed above. However, since spark reuses addresses (currently), you can still apply stuff like timing attacks to discover the underlying address. This should be addressed soon by the spark team (they are switching to a dynamic address model).
2025-10-11 22:37:41 from 1 relay(s) ↑ Parent Reply