Tim Bouma's avatar
Tim Bouma
trbouma@getsafebox.app
npub1q6mc...x7d5
| Independent Self | Pug Lover | Published Author | #SovEng Alum | #Cashu OG | #OpenSats Grantee x 2| #Nosfabrica Prize Winner
Tim Bouma's avatar
Tim Bouma 3 weeks ago
Surfacing this again for discussion - sooner or later we are going to need a story for nostr PQC support. I think the first step is to extend the signature scheme and have relay implementations that can recognize the new signatures. Existing relay implementation can just ignore the events. #PQC
Tim Bouma's avatar
Tim Bouma 0 months ago
An infographic of the Silent Payments flow (thanks, Codex!). With Silent Payments, you get two additional properties: 1. Verifiability - you can independently verify that the Silent Payment address belongs to an npub (or NIP-05 address from a trusted provider) 2. Deniability - only the npub owner (having the nsec) knows how to scan and identify transactions intended for sweeping/spending. Of course, this does not solve all the privacy issues related to downstream spending, but there is no way to implicate the npub or the sender of the funds. This is crucially important in high risk situations where the donor might be as at risk as the receiver. I have working code for all of this and am now testing various wallet implementations. More to come! #silentpayments image
Tim Bouma's avatar
Tim Bouma 0 months ago
Silent Payments are as cool AF. More to come….
Tim Bouma's avatar
Tim Bouma 0 months ago
Love has no price. Everything else can eventually be denominated in bitcoin.
Tim Bouma's avatar
Tim Bouma 0 months ago
Here is an example of me accepting a Silent Payment to my address. I can only detect it if have knowledge of my nsec and the txid I am looking for (I could scan the entire blockchain if I wish, but not for now) Once the transaction is detected, I can sweep to another address of mine that is an one-time receive address. Bottom line: None of this is traceable. Unlike P2SH (which I can still use for public receipt of payment), these transactions are not linked to me, save for the knowledge of my nsec and my destination wallet private key. Note that all of the potentially trackable data is redacted except for my public Silent Payment Address image
Tim Bouma's avatar
Tim Bouma 0 months ago
You can always cancel your nostr subscription.
Tim Bouma's avatar
Tim Bouma 0 months ago
What we’ve established over the past few weeks that with 256 bits of entropy (nsec), it is possible to create an identity (npub) that can sign for things and a payment address (p2tr) that can be verifiably linked to that identity. This is way bigger than nostr social media, it is something that can be used by society and the economy writ large. I am seeing a lot of stuff about machine identity and payments - this is the answer. I also get all the hand-wringing in using this with nostr. I actually agree with all that - use with your social nsec at your peril. But that does not apply to machines, or someone requiring a verifiable payment to a one-time identity that has just signed for stuff. This simple model has massive positive implications for areas such as digital trade documentation; nostr social media, as we have seen, not so much. Nostr social media was just the starting point for the nostr protocol. There are much bigger things ahead. Onward! image
Tim Bouma's avatar
Tim Bouma 0 months ago
I am really excited about silent payments to a npub. The undeniable fact is that your npub has a Bitcoin wallet waiting to be discovered (whether you choose to use it, it is up to you). With Silent Payments, your npub can provide a static address that can be used to generate an untraceable transaction and UTXO, that only you, with the knowledge of your nsec can locate and spend. As with anything, there are a few tradeoffs, you need to scan the blockchain and test the outputs to see which UTXOs are yours for the taking. But here again, #nostr rises to the challenge - a bitcoin wallet using silent payments could also send a gift-wrapped message with the txid to look for. Now no scanning is required, and the receiving end needs only to scan for incoming DMs and when a payment comes in, locates the txid and sweeps the funds to another UTXO. I know this works, because I have implemented the same mechanism for #nostr #safebox - what looks like a payment to a lightning address, if the payer knows that it is being sent to another safebox, it skips lightning entirely and sends the funds via gift-wrapped ecash tokens, which the receiver redeems and puts in their wallet. The user thinks it’s a lightning payment - it is not - the clearance used ecash tokens behind the scenes, no lightning channel updates. This is all great for private payments - the downside is that you need trusted infrastructure to make this work, namely mints and an application service. With silent payments to a npub you get the same privacy, a default wallet, and none of the setup required. The downside is higher fees, which is OK, but most don’t realize the reason lightning payments are cheap, almost free is because someone invested in and is operating an infrastructure to give you those ‘free’ zaps. Onward! View quoted note →