Correct. You have to keep the ratcheting state outside of Nostr, which means that either only one client had access to your DM and/or different clients see different DMs, or that you have a way to import and export the ratcheting state from app to app manually, off from nostr.
The later becomes a better point of attack. You don't need to break the decryption if you can just get the state by attacking the import/export function directly.
What would this attack look like in practice, against Signal for example?
Device access, no? It’s why a lot of people think ratcheting is overkill. Because device access is total access anyway
You can use disappearing messages if you're worried about device access. Disappearing messages require ratcheting, otherwise the message history will be found on relays and decryptable. Ratcheting protects your past and future messages even if your main key is stolen by a compromised client or one-time device access.
On Signal, maybe someone who borrows your phone could link another device without you noticing? Idk. But double ratchet still protects from all the other scenarios.
Oddbean new post about login | logout 