Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nostr

nostr.com

Post reply on HN
Print view View original

281–290 of 347 posts

Re: Nostr

#281

Post by vnuge »

irq-1 wrote: post #265
tptacek wrote: post #211

I think it's worth knowing that the cryptography in Nostr appears to be a wreck. Here's a paper from EuroS&P this year, also presented at Black Hat on the crypto track: https://eprint.iacr.org/2025/1459.pdf The vulnerabilities here are pretty :yikes: * The event protocol that drives the system doesn't authenticate public keys, so asymmetric signatures are performative: attackers that can intercept messages (Nostr ser…

I tried to find out what key algorithm is used -- not listed anywhere. Everything led to pages about Blech32 (a bitcoin key encoding). https://hellonostr.dev/en/introduction/ The encoding seems to have an unmentioned/unaddressed version number included, both in the nostr doc and the bitcoin docs. npub1abcxyz... is npub (header) 1 (version) abcxyz... (key) Now take a look at the doc (linked above.)

nip01 defines the use of secp256k1. Again, the same as bitcoin.

Re: Nostr

#282

Post by msm_ »

Yizahi wrote: post #274
enether wrote: post #213

Earlier quoted context omitted.

It's still pretty affordable and not-hard to run your own Lightning node; The pseudo-bank hosted wallets people use (e.g Wallet of Satoshi) is purely out of convenience. The real lesson is that most people don't care enough about the underlying risks - they care about convenience.

If I'm not mistaken, running own Lightning node would mean opening channels to every single merchant you want to trade with AND those same merchants would need to open a symmetric channel back to you with the same amount of locked funds. And then during the transaction this system would need magically solve traveling salesman problem per each transaction in the system, taking into account that after each completed tr…

Wouldn't repeated block size increases lock out "normal people" from participating too? Hosting a local BTC node is already hard, and completely impractical on a mobile device.

Re: Nostr

#283

Post by msm_ »

littlecranky67 wrote: post #80
nunobrito wrote: post #57

Earlier quoted context omitted.

It nowhere similar to Monero in privacy, because it was never private to begin with. Please read: https://bitcoinmagazine.com/technical/state-of-bitcoin-light... And attention that Monero isn't the only privacy coin in town, but it is the one that is without doubt more attacked by governments due to its privacy. You don't see the same treatment for neither LN nor bitcoin, instead you see governments supporting it. Th…

Your link is from 2022 - blinded paths are now here in lightning. Async- and trampoline payments are around the corner. The article is heavily outdated. I am involved in Lightning and run my own node - it is pretty much private enough for all sorts of micro payments for content creators. Not private enough for organized crime to move large sums, agreed. You also forget to mention the 51% attack monero recently suffer…

>I am involved in Lightning and run my own node - it is pretty much private enough for all sorts of micro payments for content creators. Not private enough for organized crime to move large sums, agreed.

I don't get it. It's like saying bank transactions are private enough for all sorts of micro payments for content creators, but not private enough for organized crime to move large sums. Technically true, but...

It's either private or not.

Re: Nostr

#284

Post by duskwuff »

vnuge wrote: post #268
tptacek wrote: post #239

Earlier quoted context omitted.

If you read the entire paper you'll see that the paper presents a formalized set of security goals that acknowledge Nostr uses public keys as identities. They haven't misunderstood the system. Meanwhile: the cryptography is obviously unsound: it relies on unauthenticated CBC, and signatures that aren't verified, and provides attackers with the ability to coerce users into following links.

nostr cryptographic developer here (author of libnoscrypt C library) Nip04 has been deprecated, and to be clear, in practice the nip04 payload is in a signed nip01 event wrapper. nip44 replaced nip04, which has been reviewed/audited. Does use authenticated encryption in the message payload with forward secrecy, again in practice wrapped in a nip01 event, singed by the author, usually by the same cryptographic softwar…

How robust is nostr against downgrade attacks - can an attacker induce users to use nip04, or are there safeguards against this?

(I have no significant knowledge of the protocol; if this is a meaningless question just say so.)

Re: Nostr

#285

Post by Cameri »

BinaryIgor wrote: post #210
jeroenhd wrote: post #142

Earlier quoted context omitted.

"Accounts" in this case are just a public/private key pair. You can host your own relay (and nobody will hear what you have to say unless they subscribe to it), but you can use the same public key ("account") on any nostr relay. You can broadcast your posts to all relays, or just some, or just your own, depending on how you feel. You can, in theory, generate a new key for every post if you want to. The relays don't c…

Yes; and because your key is your identity, losing your key or having it stolen basically means that you have to start from scratch; there is no "I forgot my password" mechanism

For identities to be truly decentralized, there's no one you could run to to ask permission to change your password. Either you own your identity, or someone else does.

Your identity, BinaryIgor only exists in ycombinator, and for as long as ycombinator allows it, and only ycombinator can allow you to change your password. I can't recall how accounts are created here, but likely it also depends on linking it to your email identity as well. If ycombinator disappears, your identity goes down with it.

Re: Nostr

#286

Post by throwaway290 »

jazzyjackson wrote: post #219
nunobrito wrote: post #107

Earlier quoted context omitted.

He just detailed a very weird and vague way that is unbelievable. I'm a user since January 2023, there were plenty of well-known web clients already available back at that time (e.g. coracle, amethyst, etc). You enter the clients, there is a WoT by default and shows the most proeminent conversations typically. My experience was never as the one he describes. Not even at the beginning, as you can see for many others h…

I know if I encountered CP on a burgeoning social network the first thing I would do is go on my blog and detail the steps to reproduce.

nostr is not a social network. per words of every nostr promoter. it's a protocol. it's like email

also you'll be committing an offence. the first thing you do is report it to authorities, not doing it is illegal. so that's half your day gone. then blogging about how to find it before it's taken down probably also illegal. literally no one wants any of this on a random day)

Re: Nostr

#287

Post by Cameri »

causalitycone wrote: post #43

The Nostr protocol as such does not look like a huge revelation. JSON, hashes, signatures, and that’s about it. JSON is not a cryptographer’s best friend, by the way. Effectively, everything else is left to be implemented. That probably explains try-everything-see-what-works approach to client apps?

Could you elaborate on "JSON is not a cryptographer's best friend"? JSON is not a dog, for example, but that doesn't tell much.

Re: Nostr

#288

Post by Cameri »

camillomiller wrote: post #5

I find open protocols the most naive endeavour in tech nowadays. The reason why social media protocols work is because the incentive is to have them siloed, controlled, and artificially convincing people through algorithmic suggestions that posting what they had for lunch is somewhat interesting. These protocols seem to think that people actually want an alternative to what Instagram, Facebook, X etc. give them. They…

> Do you wanna change social media? Try and find and effective way to bring them down.

You don't change social media by building yet another closed protocol. You'd be building more of the same. The only option left is to build open protocols, and nostr is another attempt. Checkmate.

Re: Nostr

#289

Post by lxe »

jonstaab wrote: post #275
Wilduck wrote: post #271

Earlier quoted context omitted.

I don't want to be mean, but this post has exactly the problem the person you're replying to was complaining about. The person you're replying to, I think, would like an explanation that reads more like "It's like Twitter, but not tied to a mega-corp, just for you and your pals". I don't know if that description actually fits Nostr though because, like the person you're replying to, I have a pretty hard time understa…

My point is that question is sort of a category error. It's like asking what type of business the internet is for, or what the use case of smart phones is. Here are a few things built on nostr, with specific use cases: primal.net is a twitter-like client with bitcoin micropayments and long-form articles (also see coracle.social, nosotros.app, jumble.social, Amethyst, Damus, yakihonne.com and many others); zap.stream…

"nostr is a simple distributed protocol to build internet applications for social networking, communication and media.

It requires lightweight relay servers, as opposed to large federated servers like in mastodon or email, or fully p2p like scuttlebutt.

It can be used to some extent via a browser using web clients, but it's best used alongside extensions for authentication and key management"

That is what I'm looking for. I'm not sure it's a good description, but I wish something like this was front and center

Re: Nostr

#290

Post by jonstaab »

lxe wrote: post #289
jonstaab wrote: post #275

Earlier quoted context omitted.

My point is that question is sort of a category error. It's like asking what type of business the internet is for, or what the use case of smart phones is. Here are a few things built on nostr, with specific use cases: primal.net is a twitter-like client with bitcoin micropayments and long-form articles (also see coracle.social, nosotros.app, jumble.social, Amethyst, Damus, yakihonne.com and many others); zap.stream…

"nostr is a simple distributed protocol to build internet applications for social networking, communication and media. It requires lightweight relay servers, as opposed to large federated servers like in mastodon or email, or fully p2p like scuttlebutt. It can be used to some extent via a browser using web clients, but it's best used alongside extensions for authentication and key management" That is what I'm looking…

Going back to the site, I see what you mean. Very fair criticism. The site appeals to a bunch of implicit ideals without defining its terms.
Post reply on HN