Thread

Some explanation View quoted note →

Why would I not that option or ability? View quoted note →

I like delegation. Years ago I implemented such a thing from the start in Rein. There I called it a master key and a delegate. The master key was there just to sign the "profile" the delegated one was held by the client.

GitHub

GitHub - ReinProject/python-rein: Client for a decentralized freelancing market

Client for a decentralized freelancing market. Contribute to ReinProject/python-rein development by creating an account on GitHub.

Good idea. I've been thinking about this also. For now, before we have a technical solution, we could post a note and keep it in our public bookmarks. Below is the Npub of my account backup #1. I have set my main account to follow my backup account. I will keep the robot avatar for my backup until I use it. Possible hashtags to find the note: #Npub #MyNpub #MyNostrBackup #LeoFernevak #MyNostrLeoFernevak #MyNostrBackupLeoFernevak #NpubLeoFernevak @npub10zc3...m883

I would use something like this. Nothing to contribute. Just interested in learning about it. View quoted note →

Yes.

Yes, but I would expect that to be part of onboarding: Hey user, this is your pirvate key, store it safe, and here is you recovery key, store that somewhere else. Of course clients should offer that as a function to use at any time. Also the keys could be generated from easier to record seeds with enough entropy.

Only if it works automatically for your followers. (Doing that properly seems like it belongs in a new kind, not a note, or if in a note it should be in a standard format)

Yep. It would be useful in that case.

Have a backup that people can follow. What I used to do on Twitter. View quoted note →

It sounds insane to hand over my keys but for something like nostr.. I might approach it differently if it becomes my universal passport for *everything* and gets used very heavily all the time.

I’m listening

Just saying in case the DM or other bug was to get out of hand. Still not sure if I unnecessarily worried about the DM private bookmarks yada yada bug. Anyways, it would suck to lose your id (🤔 perhaps could be a blessing in some other ways cuz of.... Social Dilemma 😅). Cheers 🤙

Your nostr client is already compromised by then right?

Have thought for some time that the best way to accomplish this is with a servant/master system. Servant pubkey is the main that you use regularly. Servant identifies a master pubkey, with the note that does so including a small snippet of signed text from the master. The master would ideally be a cold-storage derivation that sees nearly no use. The master would only have one primary purpose, that being account replacement. It can send a note that identifies an account as burned, and identifies the replacement. Said note should be signable as airgapped. Clients would then swap over to the replacement and otherwise maintain continuity of messages.

Yes

Yep

absolutely. im curious how this would be handled though?

Looks simple, so yes

I have mentioned this before but I didn't get enough response on this. Let's how this goes. View quoted note →

Yep

Does it require putting something on a blockchain somewhere?

depends on how that note is validating, what is being stored, and where

Yes

I'd do it.

Sooo not sure if this input helps but I've always wondered why we can't create revocation keys or add expirations to the nsec for this exact reason. I like the notify of new key proposal but if we already have a workflow that works for gpg keys, then why not adopt it?

It depends. If tjis means to submit my private key to another third party service i woild not because the risk that this third padty would be compromised is larger than a single entity. View quoted note →

Sure.

I think there should an application that someone could use to inspect if his or her nsec is not compromised.

If the application is possible, time lock event can be initiated if the account is found compromised. Doing that will enable the rightful owner to perform reset on his or her account.

I wrote a note about this type of issue yesterday. My feeling is that the key we use day to day should be a secondary key that can be changed by signing an event with a primary key (preferably a hardware one). Rationale being that the key used to log in day to day is frequently e posed to apps using it so is at a higher risk and should be quick and easy to drop. For bigger social media users the 30 days could be pretty problematic as from my understanding the compromised key would still be what most clients see as the real identity.

What ways are you thinking?

Yeah , why not ? Seems like a good idea

No, I would just create a new anonymous identity nsec.

Yes.

No entiendo muy bien estas cosas técnicas pero joder que brutal el ambiente de desarrollo que hay aquí en #NOSTR View quoted note →

Definitely

This makes sense to me, @PABLOF7z... Have you gotten any strong objections or criticisms?🧐🤔😯

I‘d love to have this 🤩

A 2fa solution where you would sign a bitcoin address you own and it's set in your profile could also be used to nuke old npub and change to new, new profile would sign the same btc address.

I think we should just take good care of the nsec and use tools like nsecbunker when possible to generate disposable little nsecs. Nostr identity won't go away by simply having the nsec compromised. We literally know each other on a good level to know someone is pretending to be someone else. Not saying it won't create confusion to start with, but I don't see it as horrible as losing a wallet seed phrase or more. Improving UX could prevent the majority of such accidents without having to implement a complex solution that most won't be able to use anyway. Unless they could of course. View quoted note →

If it is simple to recover it.. people will definitely appreciate that feature.. in upcoming future our ID is the most important thing we'll have! 💜🎩⚡🧡 #thenostr View quoted note →

sounds dope

nope

Your internet identity is so important lol

that means giving up sovereignty over your nsec so, no thanks

I don't even care honestly. I would just start again.

If your nsec is compromised, isn't that gg? Would you basically recover your note history to a new nsec while some other POS is masquerading as yourself? I'm very interested to see what comes of this because I'd hate to "start over" god forbid.

Yes.

Yes

Nsec + Passphrase 😅 (NIP-39?)

Yez

Nah. Much more concerned with protecting my spirituality & being a spiritual warrior for humanity. We all serve our own purposes 💜💁🏻‍♀️