Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nostr

nostr.com

Post reply on HN
Print view View original

211–220 of 347 posts

Re: Nostr

#211

Post by tptacek »

I think it's worth knowing that the cryptography in Nostr appears to be a wreck. Here's a paper from EuroS&P this year, also presented at Black Hat on the crypto track:

https://eprint.iacr.org/2025/1459.pdf

The vulnerabilities here are pretty :yikes:

* The event protocol that drives the system doesn't authenticate public keys, so asymmetric signatures are performative: attackers that can intercept messages (Nostr servers, the presumed adversary of an E2EE messaging system) can just swap out keys and re-sign.

* Two major clients, the mobile phone Damus app and the web Iris app, don't even verify signatures to begin with.

* DMs in this system are unauthenticated CBC, so attackers can simply bitflip messages and events to say what they want.

* The apps do automatic link-preview, so they've managed to reconstitute the EFAIL attack: attackers can locate links within messages (they'll be revealed by SNI and DNS anyways) and then bitflip them to point to attacker-controlled servers, exposing both the URLs (which will often contain tokens) and, with a bit of extra work, the message itself (by tacking `?foo=` onto a URL).

* There's no key separation in the system, so you can trick users into running a subprotocol other than the messaging system, then establishing a session key, which will then be used for messaging.

These are really basic errors; this is mid-aughts-level cryptographic engineering. There are probably a variety of other reasons to use Nostr, but end-to-end security does not appear to be one of them.

Re: Nostr

#212

Post by rgreeko42 »

My "apolitical" shirt has people asking a lot of questions already answered by my shirt. What an odd word to use in the first sentence of your product description, which also includes the word "open", an inherently political concept in this context.

Did/does Nostr have some cryptocurrency connection or am I thinking of something else?

Re: Nostr

#213

Post by enether »

Yizahi wrote: post #187
anon1395 wrote: post #16

Earlier quoted context omitted.

Bitcoin is regulated as hell

And extremely centralized in the so-called Lightning version. Due to ridiculously absurd requirements of the Lightning layer (bidirectional channels on L1, locking funds in advance, solving NP-hard problem thousand times per second a scale etc.) everyone basically resorts to using very few centralized entities as a pseudo-bank, who issues virtual paper, IOUs, which which wallets trade on L2. Basically all negatives o…

It's still pretty affordable and not-hard to run your own Lightning node; The pseudo-bank hosted wallets people use (e.g Wallet of Satoshi) is purely out of convenience.

The real lesson is that most people don't care enough about the underlying risks - they care about convenience.

Re: Nostr

#214

Post by enether »

TheAceOfHearts wrote: post #7

Last time I tried navigating the Nostr ecosystem I found their Twitter-equivalent platform and it was full of people posting about cryptocurrencies and other topics that weren't of particular interest to me. Are there any major figures of interest primarily participating on any Nostr platform? Or is there any kind of uniquely interesting content that is being primarily produced and shared on Nostr?

It's inherently a chicken and egg problem. If HackerNews didn't exist and the Nostr community created it - it'd be filled with the same content.

Network effects are everything. The tech can be good but the product may not be - solely because of the network effect. Still - pretty good tech!

Re: Nostr

#215

Post by skeptrune »

rgreeko42 wrote: post #212

My "apolitical" shirt has people asking a lot of questions already answered by my shirt. What an odd word to use in the first sentence of your product description, which also includes the word "open", an inherently political concept in this context. Did/does Nostr have some cryptocurrency connection or am I thinking of something else?

yeah, lots of bitcoiners

Re: Nostr

#216

Post by pndy »

TheAceOfHearts wrote: post #7

Last time I tried navigating the Nostr ecosystem I found their Twitter-equivalent platform and it was full of people posting about cryptocurrencies and other topics that weren't of particular interest to me. Are there any major figures of interest primarily participating on any Nostr platform? Or is there any kind of uniquely interesting content that is being primarily produced and shared on Nostr?

Two months ago I visited Primal by accident (which appears to be some Nostr instance) and the first impression I've got it's a platform for promoting crypto because streams were just about bitcoins all around

Last year one of users on mastodon I was casually talking to decided to move to Nostr - he claimed in his last posts that some features like pools and voting are locked behind payments there. Can someone shed some light on that? I couldn't find any info if that platform does contain paid features.

Re: Nostr

#217

Post by jasonvorhe »

BinaryIgor wrote: post #208

I've revisited this idea/protocol a few times and still have my doubts: * is there even a need for it? I would say that most people are quite happy with centralized platforms; I don't see it changing anytime soon (why?) * wouldn't we end up in the centralized world anyways? Even though there could be multiple NOSTR clients and relays, we all know how network effect works - people will flock to a single or a few best…

It's quite common for people with rather controversial topics to have backup accounts listed in their bio because centralized platforms are so prone to deplatforming people. If that's acceptable to you, then nostr probably isn't for you. I prefer not to beg anyone for permission to publish my opinions on the internet.

Re: Nostr

#218

Post by jazzyjackson »

numpad0 wrote: post #126
staticelf wrote: post #121

Earlier quoted context omitted.

1. I am not a layperson. I used nostr while it was still under active development and when it only had a few NIPs finished. 2. I have been to Japan several times, I know the difference between anime/hentai/lolita and stuff like that. This is not what I was experiencing. 3. I have nothing against pornography in general. The issue is that when people bring up shit like this, we are not taken seriously and this hurts pr…

- The smaller group says they see TONS of $thing, - the larger group says they see NONE of $thing, - both are looking at the EXACT same thing. -> The disagreement is in the definition of $thing. It can't get clearer. How else would you explain it? Either you're lying(I guess not), or your definition is way off, or those secret underground organizations made some mistake and their secret Facebook group illegal content…

Or maybe nostr is based on relays and no one user sees the whole network?

Re: Nostr

#219

Post by jazzyjackson »

nunobrito wrote: post #107
throwaway290 wrote: post #98

Earlier quoted context omitted.

Do you really think somebody would try out a new platform 2 years ago, immediately drop it due to shady stuff and remember all the non trivial steps involved in this process? > you can even install NOSTR clients directly from the App and Play store since years Since feb 2023, apparently;)

He just detailed a very weird and vague way that is unbelievable. I'm a user since January 2023, there were plenty of well-known web clients already available back at that time (e.g. coracle, amethyst, etc). You enter the clients, there is a WoT by default and shows the most proeminent conversations typically. My experience was never as the one he describes. Not even at the beginning, as you can see for many others h…

I know if I encountered CP on a burgeoning social network the first thing I would do is go on my blog and detail the steps to reproduce.

Re: Nostr

#220

Post by BinaryIgor »

jasonvorhe wrote: post #217
BinaryIgor wrote: post #208

I've revisited this idea/protocol a few times and still have my doubts: * is there even a need for it? I would say that most people are quite happy with centralized platforms; I don't see it changing anytime soon (why?) * wouldn't we end up in the centralized world anyways? Even though there could be multiple NOSTR clients and relays, we all know how network effect works - people will flock to a single or a few best…

It's quite common for people with rather controversial topics to have backup accounts listed in their bio because centralized platforms are so prone to deplatforming people. If that's acceptable to you, then nostr probably isn't for you. I prefer not to beg anyone for permission to publish my opinions on the internet.

Why not to have a website then? That's the only thing that where the content is truly Yours.

In NOSTR, even though yes there is more than one relay, but you still need their permission to publish; and yes, you can run your own relay - but you might host your own website too - no need for new apps and protocols to do this

Post reply on HN