Oddbean new post about login | logout well, that was a quick uninstall. i had high hopes for @keychat as they talked a big game over the past few months. however, they don't allow you to sign in with your existing nsec. maybe in the future when they allow you to use your portable digital identity, i'll try it again. keep building!
That's really anti-pattern
Agree. Nostr allows us to have one identity for all of our applications if we choose to do so.
I think in terms of security it might not be the worst idea to go with a new key for now. (I don't know, it's new and all). Overall I agree that taking your identity with you is one of the killer features of nostr.
They also talked about using a modified NIP-17, essentially making their app not compatible with other NIP-17 clients in the future. This is against the entire point of using a protocol standard. I'm losing faith in them, very fast. I hope they work with other developers and come to a compromise or NIP-17 update so things are interoperable.
You should directly address our concerns about NIP-17, rather than assuming we are deliberately not complying with NIP. nostr:note1fy2yam6h0cm628rjlyzra06t5azxuru0q88hegjxtpz5uwstztnqmy0csl
I'm not a developer on NIP-17. You should consider working with them to resolve your issues, making it more robust for everyone to use. I've already said I wished for you to work with them instead of deciding to make your application not compatible with other applications, throwing interoperability out. It's an open protocol, meaning anyone can build, but if we don't adhere to standards, then the protocol doesn't work if everyone starts to do that, right?
Under that post, I discussed extensively with one of the contributors to NIP-17, who is also a developer of 0xchat. You should be able to see the results of our discussion.
Good. Keep discussing. Hopefully you reach a consensus so you don't have to essentially fork the protocol.
What's up with the drama? This should be a technical discussion, not an "omg I'm losing faith they didn't use my key" one.
User experience for the masses. A key feature of Nostr is interoperability and portability. Breaking that essentially breaks consensus.
Hard agree. Lots of negative language towards a project that actually produced something that people were asking for albeit with some tradeoffs
Keychat has implemented a seed phrase using NIP-6. For applications focused on public notes, such as Damus, it is more beneficial for a user to use a single Nostr ID because it can accumulate more reputation. However, for apps focused on private notes like Keychat, using multiple IDs can provide better metadata privacy. A seed phrase allows users to have multiple IDs while only needing to save one seed phrase. Another point is that the double ratchet algorithm used in the Signal protocol is stateful and cannot be used on multiple devices with the same ID simultaneously. The double ratchet algorithm provides enhanced encryption security but sacrifices some multi-device synchronization capabilities. This is an issue that apps focused on public notes do not encounter. https://github.com/nostr-protocol/nips/blob/master/06.md
I believe telling a user not to DM me on this npub that shows their WoT with me or to not DM me on a currently familiar app but to download a new app, create a new account and add a secondary npub for me, is an extremely bad user experience and will lead to scammers harming users. The key is to make Nostr more simple for the masses, not overly complicated. I want a dedicated chat app very badly, but I'm not going to put new users through these hurdles to just DM me. There has to be a better way that has a nice marriage of UX and security.
Keychat's goal is not to serve as a DM for a microblogging app; it is focused on being a chat application. DMs and chat apps are different; DMs are designed to serve microblogging platforms.
It's interchangeable language.
Absolutely not. DMs prefer multi-device synchronization over forward secrecy. Chats prefer forward secrecy over multi-device synchronization.
So I should not tell people to DM me on Signal? I've been saying that for nearly a decade. My bad.
You're conflating the two & ignoring the nuance nostr:nprofile1qqsth7fr42fyvpjl3rzqclvm7cwves8l8l8lqedgevhlfnamvgyg78spz3mhxue69uhhyetvv9ujuerpd46hxtnfduq3qamnwvaz7tmwdaehgu3wwa5kuegpz4mhxue69uhk2er9dchxummnw3ezumrpdejqj9swg4 just explained. There's a difference in architecture between twitter & telephony. But if folks understand you when you tell them to "DM my cell" I guess it's a non-issue for you.
As I understood from @keychat's evidence.. You need to tell users to Chat with you on Signal but not DM you for Privacy communications.. I guess it is a great starting point to schedule and improving our privacy on private chats..
I'm not sure from the user point of view there's any difference, though.
Facts.
Honestly while this is a pain, I'm all for it. There needs to be a way for user's to guard their entire chat history in the event an nsec leaks. If a bad actor is just hoovering up my DMs waiting for my nsec to leak, then they may be able to find something from years ago that in any other application would have been able to be deleted. If people shared home addresses or any harmful personal information over a DM it can be vulnerable in time. Private relays help/fix this issue, but not all user's are going to be able to configure one. Until the day comes where messages can be ensured bad actors aren't hoovering them, I will not suggest any user share any personal info over a nostr DM with me! Even with nip44, it's still known what language the user's is likely to be speaking in, and therefor the alphabet, and even intent, which lowers the probability of a brute force ciphertext attack. While that still may be a high number, I don't want to bet on it if it's possible to rid that probability entirely!
To chat with another nostr user, we need to somehow share some information in order to connect, so that when we chat I know it is them and I'm not just picking a random person. If so, it seems that you could associate that information with a known nostr ID in a new event kind or in a metadata field. Maybe you don't want to make this association with ratchet keys or whatever they are called, in order to preserve privacy, but there needs to be something otherwise I'm just chatting to a random person I don't know if it is them. So it seems there could be a way to automate this part for a better UX. But without knowing how keychat works I can't speculate any deeper than that.