-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
We could all do it today. The technology has existed for a
very long time now. We somehow allowed the market togetto
a point where the crypto mostly benefits the corporations
using people as a product.
- -----BEGIN PGP PUBLICKEY BLOCK-----
Comment: User ID: lemmy_posting_key
Comment: Valid from: 7/31/262:00 AM
Comment: Valid until: 7/31/2912:00 PM
Comment: Type: 255-bit EdDSA (secret key available)
Comment: Usage: Signing, Encryption, Certifying User IDs
Comment: Fingerprint: 3965EF2558DE27BDF057EBD6D1800E8356A14454
mDMEamxIKxYJKwYBBAHaRw8BAQdAHa59Q90fLXONJ/dheGvaTUsh8RxpYbN5/kLk
VwhuJ8S0EWxlbW15X3Bvc3Rpbmdfa2V5iJYEExYKAD4WIQQ5Ze8lWN4nvfBX69bR
gA6DVqFEVAUCamxIKwIbAwUJBaV4ZQULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAK
CRDRgA6DVqFEVPHlAP9zcGI0AvP/I1fqIYfks8gArPWsbbXFMA3xdXuxpB0fkQD+
NEKRbjZaoyQ5MU2IAlHdfC0DWCL7gyJ/aXtJQZPOAg24OARqbEgrEgorBgEEAZdV
AQUBAQdA0itDkHmO4JKPtyK0+c+7KvaB1ub/ees6koIZo2S13wEDAQgHiH4EGBYK
ACYWIQQ5Ze8lWN4nvfBX69bRgA6DVqFEVAUCamxIKwIbDAUJBaV4ZQAKCRDRgA6D
VqFEVIaOAP9FUfaxNBI+gsBA4s6INSqhWCxhRPWCgQAk0wltsgpnkgD/bfpilGAx
XBvfnJBlHbel5z73T4IEBqIvDTHX6t9AUQo=
=kclm
- -----END PGP PUBLICKEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
iHUEARYKAB0WIQRUzy5RsYePpEjLPsQmKLxeU5C8sgUCaqIEbwAKCRAmKLxeU5C8
soZBAQCuGIZLW0SKpqqNrVOheG8U/t8YLrvLSal/MI5f3HgfowEAr6AV0lsrLmlV
5BIldH/5q5WIbiZOiyPM4O/oerODSQQ=
=jnr7
-----END PGP SIGNATURE-----
Correct, except I signed my public key. You now have cryptographic proof that I’m me. And as me, you can take my word for it that I only made that key to see what signed messages would look like on lemmy so that I could post in these sorts of situations and so that I could test Kleopatra. It’s not intended to be used for anything serious.
It should also enable anyone who wanted to send an encrypted message to me to do so.
There’s actually a social media network/protocol (which is even more decentralized than the Fediverse) built on this sort of thing called Nostr. Every message is cryptographically signed, so you own your identity (private key), regardless of where/how you access the network. Pretty cool tech overall, and lots of nice people, but a very disproportionately large amount of Bitcoin content over there.
Hard pass for me I think on nostr. The signup says to continue with google (heard of 'em) or NIP-07 (not heard of 'em), and the generate nsec button offers me an opportunity to download “my” private key. The file has a keypair and a helpful message that I can share the public key, and that I should never share the private key that it just sent me.
Maybe there’s something I’m missing, but all the previous systems I’m used to use that to mean that you generate the keypair yourself, and then you can post the public key publicly while you should always keep the private key private which breaks the guarantee of the math that only the person with the private key can undo the message that the public key locked.
I feel like there’s something I’m not understanding.
So, there’s not really “a signup” to use Nostr. That would be similar to saying “the signup” for ActivityPub – it’s just not specific enough for me to understand where you found this signup thing.
But also, you don’t really need to sign up anywhere. You just need a keypair. You can generate that offline, or use a trustworthy site to generate it “offline” in your web browser with JavaScript so the private key is never sent over the wire.
No idea what the Google login thing was. If I had to take a wild guess, maybe you found some place that also offers some key management/signing features as a way to make things more user friendly?
If it helps, the first Nostr client I ever tried was Iris.to. I thinkPrimal might be the most popular though.
(This might be the extent of my Nostr knowledge. I was never a frequent user, and haven’t really thought about it in months.)
No idea what the Google login thing was. If I had to take a wild guess, maybe you found some place that also offers some key management/signing features as a way to make things more user friendly?
I’ll buy that. I just have trouble squaring things like that with things like gpg-agent and how they cache passphrases and keep them from swapping to disk, etc. I’d want to know more about it and whether it’s generated in the browser or on the server. I’m also not even sure how I’d go about doing some sort of review of the javascript algorithms or where their random numbers come from. I’m not throwing shade on them; I just don’t know.
I’d want to know more about it and whether it’s generated in the browser or on the server.
FWIW, most of these web-based Nostr clients are just static JS files. They’re SPAs that connect to the relay servers (via WebSocket, IIRC). You can open up your browser’s devtools, go to the “Network” tab, and see what’s happening.
I don’t think I’d trust one that does any server-side rendering. No particular reason (though I’m sure I could think of some) other than it just wouldn’t feel right for Nostr.
I’m also not even sure how I’d go about doing some sort of review of the javascript algorithms or where their random numbers come from
I’d guess they just use the native WebCrypto APIs, but I have not verified. More info on native crypto APIs available in JS here:
At some point, it needs to be inside your retina, otherwise there’s no chance. Tech companies will find a way to spy and commercialize everything.
Or stop them before we get to that point with legislation, but we know that’s never going to happen.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 We could all do it today. The technology has existed for a very long time now. We somehow allowed the market to get to a point where the crypto mostly benefits the corporations using people as a product. - -----BEGIN PGP PUBLIC KEY BLOCK----- Comment: User ID: lemmy_posting_key Comment: Valid from: 7/31/26 2:00 AM Comment: Valid until: 7/31/29 12:00 PM Comment: Type: 255-bit EdDSA (secret key available) Comment: Usage: Signing, Encryption, Certifying User IDs Comment: Fingerprint: 3965EF2558DE27BDF057EBD6D1800E8356A14454 mDMEamxIKxYJKwYBBAHaRw8BAQdAHa59Q90fLXONJ/dheGvaTUsh8RxpYbN5/kLk VwhuJ8S0EWxlbW15X3Bvc3Rpbmdfa2V5iJYEExYKAD4WIQQ5Ze8lWN4nvfBX69bR gA6DVqFEVAUCamxIKwIbAwUJBaV4ZQULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAK CRDRgA6DVqFEVPHlAP9zcGI0AvP/I1fqIYfks8gArPWsbbXFMA3xdXuxpB0fkQD+ NEKRbjZaoyQ5MU2IAlHdfC0DWCL7gyJ/aXtJQZPOAg24OARqbEgrEgorBgEEAZdV AQUBAQdA0itDkHmO4JKPtyK0+c+7KvaB1ub/ees6koIZo2S13wEDAQgHiH4EGBYK ACYWIQQ5Ze8lWN4nvfBX69bRgA6DVqFEVAUCamxIKwIbDAUJBaV4ZQAKCRDRgA6D VqFEVIaOAP9FUfaxNBI+gsBA4s6INSqhWCxhRPWCgQAk0wltsgpnkgD/bfpilGAx XBvfnJBlHbel5z73T4IEBqIvDTHX6t9AUQo= =kclm - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQRUzy5RsYePpEjLPsQmKLxeU5C8sgUCaqIEbwAKCRAmKLxeU5C8 soZBAQCuGIZLW0SKpqqNrVOheG8U/t8YLrvLSal/MI5f3HgfowEAr6AV0lsrLmlV 5BIldH/5q5WIbiZOiyPM4O/oerODSQQ= =jnr7 -----END PGP SIGNATURE-----Isn’t this just signing though? It’s not encrypted, so still easy to spy on, no?
Correct, except I signed my public key. You now have cryptographic proof that I’m me. And as me, you can take my word for it that I only made that key to see what signed messages would look like on lemmy so that I could post in these sorts of situations and so that I could test Kleopatra. It’s not intended to be used for anything serious.
It should also enable anyone who wanted to send an encrypted message to me to do so.
Oh I see. Very cool :)
There’s actually a social media network/protocol (which is even more decentralized than the Fediverse) built on this sort of thing called Nostr. Every message is cryptographically signed, so you own your identity (private key), regardless of where/how you access the network. Pretty cool tech overall, and lots of nice people, but a very disproportionately large amount of Bitcoin content over there.
Hard pass for me I think on nostr. The signup says to continue with google (heard of 'em) or NIP-07 (not heard of 'em), and the generate nsec button offers me an opportunity to download “my” private key. The file has a keypair and a helpful message that I can share the public key, and that I should never share the private key that it just sent me.
Maybe there’s something I’m missing, but all the previous systems I’m used to use that to mean that you generate the keypair yourself, and then you can post the public key publicly while you should always keep the private key private which breaks the guarantee of the math that only the person with the private key can undo the message that the public key locked.
I feel like there’s something I’m not understanding.
So, there’s not really “a signup” to use Nostr. That would be similar to saying “the signup” for ActivityPub – it’s just not specific enough for me to understand where you found this signup thing.
But also, you don’t really need to sign up anywhere. You just need a keypair. You can generate that offline, or use a trustworthy site to generate it “offline” in your web browser with JavaScript so the private key is never sent over the wire.
No idea what the Google login thing was. If I had to take a wild guess, maybe you found some place that also offers some key management/signing features as a way to make things more user friendly?
If it helps, the first Nostr client I ever tried was Iris.to. I think Primal might be the most popular though.
(This might be the extent of my Nostr knowledge. I was never a frequent user, and haven’t really thought about it in months.)
https://nostr.com/
I’ll buy that. I just have trouble squaring things like that with things like gpg-agent and how they cache passphrases and keep them from swapping to disk, etc. I’d want to know more about it and whether it’s generated in the browser or on the server. I’m also not even sure how I’d go about doing some sort of review of the javascript algorithms or where their random numbers come from. I’m not throwing shade on them; I just don’t know.
I’ll look.
FWIW, most of these web-based Nostr clients are just static JS files. They’re SPAs that connect to the relay servers (via WebSocket, IIRC). You can open up your browser’s devtools, go to the “Network” tab, and see what’s happening.
I don’t think I’d trust one that does any server-side rendering. No particular reason (though I’m sure I could think of some) other than it just wouldn’t feel right for Nostr.
I’d guess they just use the native WebCrypto APIs, but I have not verified. More info on native crypto APIs available in JS here:
(FWIW, every Node.js distro I’ve ever used leveraged OpenSSL for those, under the hood. I imagine other runtimes do too.)
Nifty!
We’re not too far away from this being ubiquitous. Maybe even by the year depicted.