The benefit of a proper hardware solution is that:
- unlike nsecBunker, nsec.app and browser extensions, the impact of malware is limited
- unlike nsec.app your keys cannot be stolen by the app developer with a silent update
- unlike other “hardware” nostr signers, it doesn’t store keys in an easily dumpable ESP32 nostr:note140nfz32f6w0urdj0zv5agxznd226g6whn43n7auz7q2qkggrfeusxwuhlv
The breach was about metadata or I’m confused ?
how you want to prevent it to be dumped? using other hardwares or just designing one?
as far as i know, every hardware can be dumped with a physical access.
we were thinking about encryption of the key and asking user for pass word or fingerprint.
security is a layered approach
one of them is having a secure element
there’s more that I will publish later :)
cool, it would be cool to see your approach.
ill try to share as well, but the process is freeze in our team due the lack of time.
What's the envisioned usage like? Plug into the computer every time you log into a nostr client and manual confirmation on the hardware device every time you want to send?
Plug it in, authorize the client, then you can manually approve from the app or auto approve certain kinds.
A hardware screen is not necessary for this use case. Manually verifying for every AUTH event or reaction is going to make the UX shit.
Oddbean new post about login | logout