This depends on what you mean by 'down'.
If our APIs are down then the background signing won't work, but the web app (and pwa) will work and will allow export and signing (with an open nsec.app tab).
The web app is unlikely to be down - it's hosted by vercel cloud, and it's heavily cached in your browser so even if vercel is down it would still work from cache.
We also have roadmap for various backup strategies being auto-implemented or at least auto-suggested.
In the worst case we're permanently down or have killed our database and you clear your browser data and have no backup - then your nsec is gone.
Nip46 is a good idea, hopefully with a set of patches I sent last week we'll have major apps (habla, snort, coracle, nostrudel, etc) supporting it well on all platforms. Nsec.app or not, a good cross-platform key storage with permission management etc is way better than copy-pasting nsecs.
@hodlbod can't I create PR's to coracle bcs I'm not a collaborator? Anyhow, some improvements here https://github.com/brugeman/coracle/tree/fix/nip46_improvements
- ensure auth_url only shown once
- add nsec.app to nip46 providers
- add requested perms to connect/create_account (need to add more kinds that Coracle signs)
- remove create_account hack - it returns pubkey
I agree in theory, in practice no native app devs have shown enthusiasm. Native apps are proud of their low latency, nip46 can never get that performant and predictable. Batching solves dm decryption, and signer-relay saves one round trip, but one rt stays no matter what. Unless it's some nip46-over-ipc on the same device.
I agree in theory, in practice no native app devs have shown enthusiasm. Native apps are proud of their low latency, nip46 can never get that performant and predictable. Batching solves dm decryption, and signer-relay saves one round trip, but one rt stays no matter what. Unless it's some nip46-over-ipc on the same device.
The difference is using one website vs many, proper controls of what each site can do, e2ee encrypted key sync btw devices, coming soon 2fa, etc. A product focused on managing your nsec the best way it can.
There is no support for password protected nsec import yet, plus graphene likely to have other issues - this thing need web push notifications to work properly, not sure if those work on graphene.
It's asking for a new password that will be used to do e2ee sync of key between devices - you will use your username and this password to log into nsec.app
Not sure what's not working for you, I've just created and account there, you can see the created pubkey in console. I landed on the homepage of nostrmeet though, maybe something's wrong with result handling?https://i.nostr.build/Dzr4.png
Ok Safari is a problem. The error message will be more meaningful and an explainer will be shown. You should go to ios setting advanced experimental and turn push api on and then add nsec.app to homescreen as pwa. Then this error should go away. I need to do more testing on apple devices
Nsec.app on iOS needs these settings for now, until the web push technology graduates from 'experimental'. Not sure if 'add to homescreen' requirement stays or not. On other platforms it works out of the box.
Nostr-login is nip46 client, noauth/nsec.app is nip46 server (running in your browser) - there isn't much more than that.
The smoothest mobile-first signup experience is when you just generate nsec in your client and eventually when user is ready start explaining to them how to get their nsec 'reused' in other apps. If you need to immediately give them an option to sign into other apps then you could host your own nsecbunker instance and generate nsecs inside it and store on your server - it would be as smooth, but custodial. The next option is nsec.app - non-custodial, but more friction on some platforms/browsers like iOS or Brave.
Take your name@nsec.app and use it to login to npub.cash to try. Most apps have limited support for this type of auth, that's why it might be failing in your case.
You can generate new keys inside the app and try logging in somewhere to see how it works, no need to put your real keys for starters. The app works pretty well and we're working hard on improving it.
Your keys are in your browser, we just give you a username to simplify logging into apps, and password is to enable end to end encrypted sync of your keys between devices. Technically there is no need for an account, but then connecting to apps becomes much trickier, and moving keys btw devices too.
On iOS you need to go to Settings, Advanced, Experimental and enable Push API, and then add nsec.app on homescreen. Then it should start working in the background. But I haven't done extensive iOS testing yet, so no guarantees there.
I am skeptical about both the problem statement of "email+password are failing tech" and the solutions proposed for nsec failures.
A good solution for nsec sharing seems to be nip49 - nsec should only be exported in encrypted form. Adding a warning or a different nsec formatting doesn't help a user who is in a rush and copy pasting stuff around and clicking 'publish'. Storing nsec in keychain is great, but it's not available on many platforms.
Also nsec is as prone to phishing as passwords - if apps keep asking for your nsec. That's why nip46 adoption should make a difference - no nsec sharing, and it's an open protocol and you're not locked in to a single SSO provider.
Topics and sub feeds from lists are awesome! And nip46/64 too 😂
nostr:nevent1qqsfqgxd8qver85ns835szpt744n4lu63wfjeezu5cck564r3hh2mscpz3mhxue69uhhyetvv9ujumn0wd68ytnzvupzpd7x76g4e756vtlldg0syczdazxz83kxcmgm3a3v0nqswj0nql5pqvzqqqqqqyuj8lat
Added this - the last param to connect and create_account is the list of requested permissions, i.e. sign_event:1,sign_event:3 implemented at nsec.app and nostr-login, check in action on nostr.band. Any feedback? Should we be adding this to nip46?
https://i.nostr.build/o9rx.jpg
Sorry, I didn't mean to discourage you from providing feedback.
Some nip05 services also provide email service using the same name, but not sure if that's relevant here.
The nip05 and password can be used to sign in to (soon to be) any nostr client using nsec.app or other nip46 implementations. Try signing up on nsec.app (or import your relay keys there) and then you can use your name@nsec.app to sign in to nostr clients like Nostrudel, Snort, Habla etc.
You can now transfer usernames in nsec.app!
Many people tried nsec.app and claimed their preferred username, but due to UX issues have it attached to throwaway test keys. We've (hopefully) fixed the signup UX, but also added a name transfer feature. You can now transfer your username to your real keys.
Make sure you reload the app properly (open tab, close tab, open again) to get the updated version with this feature. There is a menu button near your nip05 name in the app, where you can request a transfer to a specified npub. That npub then would have to change their username manually to the transferred one to "accept" it.
We've also made some serious improvements to the app, particularly with how well it works when your keys are imported into several devices/browsers. If you've had issues in that mode - please try this new version please.
Here is a quick demo of the name transfer:
https://v.nostr.build/zGgZ.mp4
I see 'calle' assigned to your npub https://nsec.app/.well-known/nostr.json?name=calle
In fact I see 3 other names assigned to your npub too. I guess it's just that the old name was saved in your browser under your npub. I should fix the app to allow you to edit name to the one already assigned to npub on the server. Meanwhile you can try clearing nsec.app data in your browser and then login with calle@nsec.app and you should see it there.
Usernames (nip05 names) are case-insensitive. The app should convert entered names into lowercase, but doesn't in this screen - will fix that. Try typing in lowercase, should work.
Deleting keys from browser is a dangerous operation, we will add it when we have a proper flow in place, like "please make sure you export your keys first" etc. Btw you can already do encrypted nsec export (nip49) in key settings, you can do that and then just clear the browser data for nsec.app, and then import back only keys that are needed, all apps and connections should be synced back from relays.
Oddbean new post about login | logout
Notes by brugeman | export