Solving the Nostr web clients attack vector

(fiatjaf.com)

37 points | by evanjrowley 2 days ago

5 comments

  • evanjrowley 2 days ago
    I did not create this article but was intrigued to see an attack vector for the Nostr protocol being highlighted.
  • mmmmbbbhb 9 hours ago
    I'd say this is the least of nostr's problems right now.
  • RainyDayTmrw 23 hours ago
    See also: Zooko's triangle[1], a fundamental limitation and trade-offs for names.

    [1]: https://en.wikipedia.org/wiki/Zooko%27s_triangle

  • evbogue 22 hours ago
    The specific attack is not being highlighted in this article. Are we worried about keypairs being stolen and used to push malicious messages to the network? Lightning wallets emptied? Direct messages being read?
  • paride5745 23 hours ago
    I’m confused.

    What’s the point of the article?

    How’s the author compromised by the Mossad?

    What would the attack be?

    • jazzyjackson 18 hours ago
      Agreed it’s not a great article because it expects the reader to have context and a little imagination, but last I checked what the nostrilfolk were up to it was typical for a web app to ask for your private key (Nsec) and you’re just supposed to trust that app to take actions on your behalf (why nostr isn’t a browser extension that simply signs transactions clientside I don’t know)

      So the attack vector is you change what you do once you get a nostridumbass to enter their nsec, Mossad is just mentioned as a catchall for potential attackers.

    • hackernudes 20 hours ago
      The article is about accessing a service (nostr) through a hosted web app. The domain or server that is hosting the app could be compromised and serve a bad app.

      Posts on nostr use a key pair so when you see a post from foo you know it's the same foo you knew from last week. Also, posts are shared to and stored on multiple independent servers (called relays).

      A compromised app could serve you fake posts or censor stuff.

    • beefnugs 19 hours ago
      Seems like the age old ease of using a website, vs running your own copy of open source software after reading and understanding it in its entirety (unsolvable mess)