Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nostr

nostr.com

Post reply on HN
Print view View original

231–240 of 347 posts

Re: Nostr

#231

Post by fiatjaf »

tptacek wrote: post #211

I think it's worth knowing that the cryptography in Nostr appears to be a wreck. Here's a paper from EuroS&P this year, also presented at Black Hat on the crypto track: https://eprint.iacr.org/2025/1459.pdf The vulnerabilities here are pretty :yikes: * The event protocol that drives the system doesn't authenticate public keys, so asymmetric signatures are performative: attackers that can intercept messages (Nostr ser…

Unfortunately this paper doesn't live up to its goal of being a cheap attack on Nostr.

The fact is that clients do verify signatures from events received from servers, that is in the protocol specification and should be obvious to anyone mildly honest.

The entire assumption of the paper is that clients don't do that and it is void. Yes, they did find a couple of clients 2 years ago that didn't verify signatures -- so much for a vulnerability in the protocol. I guess they wanted Nostr to have a code police arresting client developers who didn't finish their implementation?

Aside from that the attacks they demonstrated depend on a bunch of other absurd circumstances (like you have to manually and voluntarily type the URL of the attacker server in order to be attacked) but it's not even worth talking about them since the basic assumption is so completely false already.

The encrypted messages stuff is not even a core part of Nostr anyway, Nostr is a broadcasting protocol for public or semi-public content. Encryption can be added on top and there are multiple ways and proposals for how to do it, including an implementation of MLS and other methods and I personally mostly do not care about any.

I wish the paper authors were more honest and republished their work with the title: "the dangers of trusting a cryptographic signature without verifying it", but I imagine that it would have been too obvious and worthless if it was phrased like that.

Re: Nostr

#232

Post by jb55 »

tptacek wrote: post #211

I think it's worth knowing that the cryptography in Nostr appears to be a wreck. Here's a paper from EuroS&P this year, also presented at Black Hat on the crypto track: https://eprint.iacr.org/2025/1459.pdf The vulnerabilities here are pretty :yikes: * The event protocol that drives the system doesn't authenticate public keys, so asymmetric signatures are performative: attackers that can intercept messages (Nostr ser…

> The event protocol that drives the system doesn't authenticate public keys, so asymmetric signatures are performative: attackers that can intercept messages (Nostr servers, the presumed adversary of an E2EE messaging system) can just swap out keys and re-sign.

This is completely nonsense, most clients do in fact check signatures. All relays do as well.

> Two major clients, the mobile phone Damus app and the web Iris app, don't even verify signatures to begin with.

Author of Damus here. this is an analysis of an old version. This has since been fixed. In the early days we connected to a fixed relay list of trusted relays. These relays verified signatures. This was just a pragmatic tradeoff thing until we had an optimized work queue for verifying notes (this lead to nostrdb, a custom embedded nostr database built on lmdb. it's a sqlite but for nostr https://github.com/damus-io/nostrdb)

> DMs in this system are unauthenticated CBC, so attackers can simply bitflip messages and events to say what they want.

not really true since the whole note is covered by a secp256k1 signature.

> The apps do automatic link-preview, so they've managed to reconstitute the EFAIL attack: attackers can locate links within messages (they'll be revealed by SNI and DNS anyways) and then bitflip them to point to attacker-controlled servers, exposing both the URLs (which will often contain tokens) and, with a bit of extra work, the message itself (by tacking `?foo=` onto a URL).

you can turn off these, you can turn off images as well. people should run a VPN of course if they are worried about these things.

Re: Nostr

#233

Post by jasonvorhe »

maxloh wrote: post #72
dbushell wrote: post #34

A big misconception I've seen is the assumption that Nostr relays are federated and share messages between one another. This is not how it works. So if you're building a "Twitter clone" the client app must search multiple relays and post to multiple relays. If clients are not using a relay in common they cannot see one another. The end result is a bad experience for both user and developer. Using a single relay is ce…

It is somehow misleading to feature a Twitter clone on the front page when Mastodon is a better way to achieve that. The protocol's real value lies in other use cases.

Mastodon merged their server-side recursive fetching of remote replies feature in the summer of this year so unless instance admins used 3rd party scripts to achieve that you couldn't rely on your reply actually being shown to the recipient. ActivityPub is complicated like that.

Re: Nostr

#234

Post by jb55 »

keiferski wrote: post #65
t1E9mE7JTRjf wrote: post #52

Earlier quoted context omitted.

That's more or less how nostr works, except instead of websites there are notes (a generic type which can be anything - including website content), and instead of servers there are 'relays'.

Yeah the more I read about it, the more it does sound somewhat similar to what I was proposing. However, the copywriting there is not in this vein at all. IMO the metaphor of personal websites is a simple, universal one that most people can understand. Nostr seems unintelligible to anyone that isn't pretty technical.

most nostr apps you can click a single button to create an account, since it just generates a keypair. no email verification, nothing. what is simpler than that?

you don't even need to know how to host something on a server, the relays do that for you.

Re: Nostr

#235

Post by philip1209 »

The issue with all of these open social protocol is that they fail to grasp that they are built for entertainment, and hence the modulated emotional reactions are a feature not a bug.

Re: Nostr

#236

Post by lxe »

Why can't these projects separate the use-cases from philosophies and from implementation when presenting them?

At first glance I don't understand what this is. Is it a social network? A protocol? "Pro-censorship? I need to read some blog article...

It's been like this with scuttlebutt/gossip, and rest of the alternative internet/fediverse with mastodont and activitypub and diaspora. Instead of asking questions like "How is this different than email? How does it compare to twitter?", I have to start with "What am I looking at? A technical implementation or a product? Is it a website or an app? What am I supposed to do with this?

There's also Urbit, which I'm sure not a single one of you can explain exactly what it is.

It's not as bad as "Web3", I'll give it that.

Bluesky got it right. So did gemini to some extent.

Re: Nostr

#237

Post by sealeck »

ursuscamp wrote: post #230
tptacek wrote: post #211

I think it's worth knowing that the cryptography in Nostr appears to be a wreck. Here's a paper from EuroS&P this year, also presented at Black Hat on the crypto track: https://eprint.iacr.org/2025/1459.pdf The vulnerabilities here are pretty :yikes: * The event protocol that drives the system doesn't authenticate public keys, so asymmetric signatures are performative: attackers that can intercept messages (Nostr ser…

So, I was part of the Nostr community for quite a while and was the author of a popular Nostr extension for Safari, before eventually giving up on Nostr for various reasons. I haven't read that entire paper. Mainly, I skipped to the section you mention here: > The event protocol that drives the system doesn't authenticate public keys, so asymmetric signatures are performative: attackers that can intercept messages (N…

> how can you verify that a user with a certain public is who they say they are instead of an impostor

This sounds awfully much like a cryptography problem to me!

Re: Nostr

#238

Post by nunobrito »

cropcirclbureau wrote: post #198
nunobrito wrote: post #15

Earlier quoted context omitted.

https://yakihonne.com/ tends to be a good experience for browser and has apps, after that https://primal.net is also quite good as introduction since their UI is similar to what you are used in other platforms. Then there is https://www.amethyst.social/ which is excellent because it brings out more of the potential of the platform.

Word of warning: was blasted with NSFW on the first page of that link.

No you didn't. Please stop the FUD.

You and your 3 friends tend to do the same every time NOSTR is mentioned just because you use another platform. Please be honest and admit the affiliation.

Re: Nostr

#239

Post by tptacek »

ursuscamp wrote: post #230
tptacek wrote: post #211

I think it's worth knowing that the cryptography in Nostr appears to be a wreck. Here's a paper from EuroS&P this year, also presented at Black Hat on the crypto track: https://eprint.iacr.org/2025/1459.pdf The vulnerabilities here are pretty :yikes: * The event protocol that drives the system doesn't authenticate public keys, so asymmetric signatures are performative: attackers that can intercept messages (Nostr ser…

So, I was part of the Nostr community for quite a while and was the author of a popular Nostr extension for Safari, before eventually giving up on Nostr for various reasons. I haven't read that entire paper. Mainly, I skipped to the section you mention here: > The event protocol that drives the system doesn't authenticate public keys, so asymmetric signatures are performative: attackers that can intercept messages (N…

If you read the entire paper you'll see that the paper presents a formalized set of security goals that acknowledge Nostr uses public keys as identities. They haven't misunderstood the system. Meanwhile: the cryptography is obviously unsound: it relies on unauthenticated CBC, and signatures that aren't verified, and provides attackers with the ability to coerce users into following links.

Re: Nostr

#240

Post by SLWW »

The most endearing thing about Nostr is that the User IDs are just the most concise, and shortest of all ActivityPub Compat. protocols.
Post reply on HN