3 ms·

I just marked the key with my mouse, pressed ctrl+c, went to a text file, pressed ctrl+v and saved it. If someone is not capable of doing that, I am not sure I

I just marked the key with my mouse, pressed ctrl+c, went to a text file, pressed ctrl+v and saved it. If someone is not capable of doing that, I am not sure I want to read their articles. Not sure what you are referring to with "pick a service to hold your private key". The whole point of Nostr is that you don't need any service to hold anything for you.

Xeoncross 3y ago
It's actually a little more complex than that. Many people go through computers several times between moving to each new social network. You have to also A) print and store the key (yikes), B) make sure you move the file to the new computer (easy now with migration assistance) or C) make sure you are backing up your computer (a lot less people use backups than should).
- Turing_Machine 3y ago
  How is that different from passwords, exactly? Okay, maybe you can remember the passwords for services you use on a daily basis, but I must have a couple of hundred passwords to deal with, at least. Password managers can help with the data overload, but only at the cost of introducing the same single point of failure as a private key, and arguably a less-secure one.
  - reportgunner 3y ago
    You can use the "forgot password" dialog for passwords.
  - pavlov 3y ago
    It’s not different from just a password. That’s why no service uses an unrecoverable password as the only authentication mechanism because it would be a terrible usability and security problem. Ordinary people expect to be able to reset forgotten passwords. And because people are bad at managing passwords, reasonable services try to get them to use 2FA so their accounts wouldn’t get stolen. A service that uses plain private keys has both problems.
    - Turing_Machine 3y ago
      > it would be a terrible usability and security problem. Compared to, say, someone being able to compromise every account you have because you walked away from your desktop or phone while logged into email?
    - JetSpiegel 3y ago
      Just email the private key to yourself, or store in your password manager for hacker types.
  - danhor 3y ago
    In addition to the other points, "regular users" unfortunately still quite often use only a few passwords, shared between all their services. So only 3-4 passwords (and variations) to remember!
- JonathanBeuys 3y ago
  I don't know anybody who has no data they care for. Everybody has some data they never don't want to lose. So the Nostr key would be just another piece of such data. Also, losing it would not that much of a desaster. Use a new key, and let people know about it via other channels.
rebuilder 3y ago
And if your private key is compromised?
- Turing_Machine 3y ago
  And if your password is compromised? There's no reason you need to use the same private key for every service, any more than you need to use the same password for every service.
  - rebuilder 3y ago
    If your password is compromised, you start the password reset procedure the service in question provides.
- JonathanBeuys 3y ago
  Post a couple of times that the account is not to be trusted anymore and that people should check your HN account / Twitter / FB / Website to see your new account. In contrast to Twitter & Co, a compromised account does not mean you cannot post anymore.
notamy 3y ago
> Not sure what you are referring to with "pick a service to hold your private key". The whole point of Nostr is that you don't need any service to hold anything for you. Serious question: Didn't the cryptocurrency people say the same thing? Look how that went -- the tech nerds tended to do it "right," and the non-tech-nerds tended to use exchanges-or-similar that were a bit less than stable, to say the least. Am I misunderstanding?
anaganisk 3y ago
Your comment reads exactly inverse of the original dropbox comment, sure you can Ctrl+c and ctrl+v in a text file. How are you securing it and why, what does it do. Why do I have to open a text editor, to create an account. Sure I can rsync or host my files on sftp, but there is a reason why Dropbox got more popular than any of those among avg users.
- JonathanBeuys 3y ago
  A key is pretty similar to a password. "Avg users" use passwords all the time. But my post wasn't even about average users. The majority of people never publish anything.

Xeoncross 3y ago

It's actually a little more complex than that. Many people go through computers several times between moving to each new social network. You have to also A) print and store the key (yikes), B) make sure you move the file to the new computer (easy now with migration assistance) or C) make sure you are backing up your computer (a lot less people use backups than should).

Turing_Machine 3y ago
How is that different from passwords, exactly? Okay, maybe you can remember the passwords for services you use on a daily basis, but I must have a couple of hundred passwords to deal with, at least. Password managers can help with the data overload, but only at the cost of introducing the same single point of failure as a private key, and arguably a less-secure one.
- reportgunner 3y ago
  You can use the "forgot password" dialog for passwords.
- pavlov 3y ago
  It’s not different from just a password. That’s why no service uses an unrecoverable password as the only authentication mechanism because it would be a terrible usability and security problem. Ordinary people expect to be able to reset forgotten passwords. And because people are bad at managing passwords, reasonable services try to get them to use 2FA so their accounts wouldn’t get stolen. A service that uses plain private keys has both problems.
  - Turing_Machine 3y ago
    > it would be a terrible usability and security problem. Compared to, say, someone being able to compromise every account you have because you walked away from your desktop or phone while logged into email?
  - JetSpiegel 3y ago
    Just email the private key to yourself, or store in your password manager for hacker types.
- danhor 3y ago
  In addition to the other points, "regular users" unfortunately still quite often use only a few passwords, shared between all their services. So only 3-4 passwords (and variations) to remember!
JonathanBeuys 3y ago
I don't know anybody who has no data they care for. Everybody has some data they never don't want to lose. So the Nostr key would be just another piece of such data. Also, losing it would not that much of a desaster. Use a new key, and let people know about it via other channels.

rebuilder 3y ago

And if your private key is compromised?

Turing_Machine 3y ago
And if your password is compromised? There's no reason you need to use the same private key for every service, any more than you need to use the same password for every service.
- rebuilder 3y ago
  If your password is compromised, you start the password reset procedure the service in question provides.
JonathanBeuys 3y ago
Post a couple of times that the account is not to be trusted anymore and that people should check your HN account / Twitter / FB / Website to see your new account. In contrast to Twitter & Co, a compromised account does not mean you cannot post anymore.

notamy 3y ago

> Not sure what you are referring to with "pick a service to hold your private key". The whole point of Nostr is that you don't need any service to hold anything for you. Serious question: Didn't the cryptocurrency people say the same thing? Look how that went -- the tech nerds tended to do it "right," and the non-tech-nerds tended to use exchanges-or-similar that were a bit less than stable, to say the least. Am I misunderstanding?

anaganisk 3y ago

Your comment reads exactly inverse of the original dropbox comment, sure you can Ctrl+c and ctrl+v in a text file. How are you securing it and why, what does it do. Why do I have to open a text editor, to create an account. Sure I can rsync or host my files on sftp, but there is a reason why Dropbox got more popular than any of those among avg users.

JonathanBeuys 3y ago
A key is pretty similar to a password. "Avg users" use passwords all the time. But my post wasn't even about average users. The majority of people never publish anything.