5 ms·

> “Given the nature of nostr, users cannot recover from a leaked private key and must take greater precaution than they would with a username/password combinati

by pavlov 3y ago

> “Given the nature of nostr, users cannot recover from a leaked private key and must take greater precaution than they would with a username/password combination.” This is a complete dealbreaker for any end-user product. I don’t understand why crypto/blockchain fans still think it can work.

deleted 3y ago
[deleted]
Retr0id 3y ago
I'm not sure why you're getting downvoted here. In any other context, "paste in the private key that your identity is irrevocably bound to" would get you laughed out of the room. It seems to be the default nostr UX nonetheless, and that's worthy of note. I am aware of efforts to improve on this though, for example https://snort.social/e/note1crl44xk24yc2ym5xlyyfjdeumxueyguzxetseg8r0prqzmqts47sghnmgp https://snort.social/e/note1crl44xk24yc2ym5xlyyfjdeumxueyguz... - essentially the equivalent of a custodial wallet, if I'm understanding correctly.
- jgilias 3y ago
  He’s getting downvoted because that’s a solved problem in the wider crypto-space. To log in you sign a message using your hardware wallet. Nostr hasn’t grown up to that yet, and pointing out that pasting private keys is a bad idea is fair game. But implying that public private key cryptography can’t be used to log into web apps is just silly given that value worth billions is being moved around daily using such web apps.
  - halfmatthalfcat 3y ago
    There's a reason why social logins, magic links and SMS login codes are so ubiquitous now - end users want 0 friction getting into their accounts. This increases friction beyond what is currently common practice. No, the public doesn't want nor care about using a key to log in.
    - wholinator2 3y ago
      Although i have heard of SQRL [1] which purports to be a frictionless way of securely logging in with public private key encryption. I've never seen it discussed here though so I'm unsure if there's significant downside [1]: https://www.grc.com/sqrl/sqrl.htm https://www.grc.com/sqrl/sqrl.htm
      - Retr0id 3y ago
        This sounds a lot like passkeys https://developers.google.com/identity/passkeys https://developers.google.com/identity/passkeys - I'd be interested to see a more thorough comparison of the two. Both of these do a challenge-response style authentication with a particular website, and wouldn't really work as part of a decentralized system. You could use the same signing key ordinarily used to sign authentication challenges to sign nostr notes, but then you're back to square 1 really. Edit: slightly better passkey info here https://developers.yubico.com/Passkeys/How_passkeys_work.html https://developers.yubico.com/Passkeys/How_passkeys_work.htm...
        Ajedi32 3y ago
        SQRL is indeed pretty similar to passkeys. It was just invented before passkeys (before WebAuthn even) and designed to work without requiring any new web standards or changes to the existing web browsers at the time. That greater compatibility came with some UX trade-offs though. Now that passkeys exist and are widely supported by web browsers there's really no need for SQRL anymore; passkeys are a far more polished version of the same concept.
    - vezycash 3y ago
      >end users want 0 friction getting into their accounts. Why not offer both, the easy one for normal users and an option to use the more secure option.
      - krapp 3y ago
        Why not have the secure option also be easy so normal users will use it?
  - vnuge 3y ago
    I am glad Zach posted here also, I think nostr devs need some reality pull from "non-crypto normies". To be clear it is (hopefully) becoming more common practice to use a nip-07 web-extension for signing (hardware or software) or other methods such as NIP-46. To be clear though, a user on nostr will HAVE to interact with cryptography in some way as every message on the network is signed. Im working on https://github.com/VnUgE/NVault https://github.com/VnUgE/NVault as an option for more paranoid users that want a self hosted networked approach. But there are others listed here https://github.com/nostr-protocol/nips/blob/master/07.md https://github.com/nostr-protocol/nips/blob/master/07.md Finally, I wholly dislike the practice of offering an option of entering an nsec. Use a signing extension!
  - jazzyjackson 3y ago
    the wider crypto space still has no empathy for normies. if you can't somehow recover or rotate your password, it's a nonstarter by virtue of being a worse UX
rijoja 3y ago
ah physical key has the same properties and end-users seems to have been accepting that just fine for hundreds of years
- hu3 3y ago
  I can easily change my house keys. Even when someone makes a copy of it.
  - jddj 3y ago
    Plus, by design it's easy to prove that you have a private key without having to stick it in somebody else's lock.
- stetrain 3y ago
  I hate when I lose my house key and just have to leave it and go buy a new house somewhere else.
  - rijoja 3y ago
    You would need to buy a new lock tough wouldn't you? Unless you had a spare key, but that would have worked with a digital key as well, right? If someone stole your key, then they could've done anything to your house while your away, just like with a digital key, right?
- plagiarist 3y ago
  Nobody with my house key can impersonate me in my house from anywhere in the world without me knowing. The signed and notarized documents involved give me a legal avenue to remove anyone who obtains a key, instead of just abandoning the house and the equity to identity thieves.
  - rijoja 3y ago
    na but they can steal your belongings couldn't they. Obviously I didn't mean that they have all the same properties, because then they would be the same thing more or less, but that they share some properties...

by pavlov 3y ago

deleted 3y ago

[deleted]

Retr0id 3y ago

I'm not sure why you're getting downvoted here. In any other context, "paste in the private key that your identity is irrevocably bound to" would get you laughed out of the room. It seems to be the default nostr UX nonetheless, and that's worthy of note. I am aware of efforts to improve on this though, for example https://snort.social/e/note1crl44xk24yc2ym5xlyyfjdeumxueyguzxetseg8r0prqzmqts47sghnmgp https://snort.social/e/note1crl44xk24yc2ym5xlyyfjdeumxueyguz... - essentially the equivalent of a custodial wallet, if I'm understanding correctly.

jgilias 3y ago
He’s getting downvoted because that’s a solved problem in the wider crypto-space. To log in you sign a message using your hardware wallet. Nostr hasn’t grown up to that yet, and pointing out that pasting private keys is a bad idea is fair game. But implying that public private key cryptography can’t be used to log into web apps is just silly given that value worth billions is being moved around daily using such web apps.
- halfmatthalfcat 3y ago
  There's a reason why social logins, magic links and SMS login codes are so ubiquitous now - end users want 0 friction getting into their accounts. This increases friction beyond what is currently common practice. No, the public doesn't want nor care about using a key to log in.
  - wholinator2 3y ago
    Although i have heard of SQRL [1] which purports to be a frictionless way of securely logging in with public private key encryption. I've never seen it discussed here though so I'm unsure if there's significant downside [1]: https://www.grc.com/sqrl/sqrl.htm https://www.grc.com/sqrl/sqrl.htm
    - Retr0id 3y ago
      This sounds a lot like passkeys https://developers.google.com/identity/passkeys https://developers.google.com/identity/passkeys - I'd be interested to see a more thorough comparison of the two. Both of these do a challenge-response style authentication with a particular website, and wouldn't really work as part of a decentralized system. You could use the same signing key ordinarily used to sign authentication challenges to sign nostr notes, but then you're back to square 1 really. Edit: slightly better passkey info here https://developers.yubico.com/Passkeys/How_passkeys_work.html https://developers.yubico.com/Passkeys/How_passkeys_work.htm...
      - Ajedi32 3y ago
        SQRL is indeed pretty similar to passkeys. It was just invented before passkeys (before WebAuthn even) and designed to work without requiring any new web standards or changes to the existing web browsers at the time. That greater compatibility came with some UX trade-offs though. Now that passkeys exist and are widely supported by web browsers there's really no need for SQRL anymore; passkeys are a far more polished version of the same concept.
  - vezycash 3y ago
    >end users want 0 friction getting into their accounts. Why not offer both, the easy one for normal users and an option to use the more secure option.
    - krapp 3y ago
      Why not have the secure option also be easy so normal users will use it?
- vnuge 3y ago
  I am glad Zach posted here also, I think nostr devs need some reality pull from "non-crypto normies". To be clear it is (hopefully) becoming more common practice to use a nip-07 web-extension for signing (hardware or software) or other methods such as NIP-46. To be clear though, a user on nostr will HAVE to interact with cryptography in some way as every message on the network is signed. Im working on https://github.com/VnUgE/NVault https://github.com/VnUgE/NVault as an option for more paranoid users that want a self hosted networked approach. But there are others listed here https://github.com/nostr-protocol/nips/blob/master/07.md https://github.com/nostr-protocol/nips/blob/master/07.md Finally, I wholly dislike the practice of offering an option of entering an nsec. Use a signing extension!
- jazzyjackson 3y ago
  the wider crypto space still has no empathy for normies. if you can't somehow recover or rotate your password, it's a nonstarter by virtue of being a worse UX

rijoja 3y ago

ah physical key has the same properties and end-users seems to have been accepting that just fine for hundreds of years

hu3 3y ago
I can easily change my house keys. Even when someone makes a copy of it.
- jddj 3y ago
  Plus, by design it's easy to prove that you have a private key without having to stick it in somebody else's lock.
stetrain 3y ago
I hate when I lose my house key and just have to leave it and go buy a new house somewhere else.
- rijoja 3y ago
  You would need to buy a new lock tough wouldn't you? Unless you had a spare key, but that would have worked with a digital key as well, right? If someone stole your key, then they could've done anything to your house while your away, just like with a digital key, right?
plagiarist 3y ago
Nobody with my house key can impersonate me in my house from anywhere in the world without me knowing. The signed and notarized documents involved give me a legal avenue to remove anyone who obtains a key, instead of just abandoning the house and the equity to identity thieves.
- rijoja 3y ago
  na but they can steal your belongings couldn't they. Obviously I didn't mean that they have all the same properties, because then they would be the same thing more or less, but that they share some properties...