Fabio Bonfiglio's avatar
Fabio Bonfiglio
fabio.bonfiglio@fbo.network
npub1d8y4...nv5a
Code. Privacy. Automation. DAOs. Founder of FBO Developments Sàrl. Building stuff. 🪪🏴‍☠️🏳️‍🌈🇨🇭🇮🇹⛵🌍
Fabio Bonfiglio's avatar
Fabio Bonfiglio 1 week ago
Next release coming together nicely. It should be on the Zapstore in a few hours. 🤞 image
Fabio Bonfiglio's avatar
Fabio Bonfiglio 2 weeks ago
Governments are rolling out national e-ID almost everywhere: the EUDI Wallet across all 27 EU states (2026-27), Switzerland's e-ID (swiyu), Denmark's AltID already live, France, Germany, Belgium, Estonia, Slovakia → in the pipeline. Those wallets can genuinely work, and your key can even sit on your device. But your *recognized* identity is still issued, attested and revocable by an authority. It can be suspended, expire, or simply never be issued. That's not sovereignty. SISTR builds the opposite: an identity that simply *is* your key, on Nostr, existing by construction, no issuer, no registry, nothing to revoke. Plus the protocols for Web-of-Trust certification & validation schemes, and zero-knowledge proofs to prove facts without disclosing who you are. Bitcoin solves the money problem. In the same way, the era of "one entity decides whether your identity is valid" MUST end.
SISTR — Sovereign Interactions Stack for Trustless Relationships
SISTR is an open protocol built on Nostr that brings sovereign, offline-capable identity proofs, structured credentials and privacy-preserving zero...
 #did #nostr #sistr #sovereign
Fabio Bonfiglio's avatar
Fabio Bonfiglio 3 weeks ago
Following this week’s sad Coldcard incident, I’ve seen several people asking whether the same problem could arise when generating an nsec. The short answer is that the issue of entropy is VERY important for ANY generation of a new private key of any sort. In CustID, when the user generates a new identity, the exact process is as follows: - The native Android class `java.security.SecureRandom` is used. It draws from `/dev/urandom` and the Linux kernel’s hardware entropy. - 32 random bytes are generated via `rng.nextBytes(ByteArray(32))`. - The validity of the secp256k1 scalar is then verified using `Secp256k1.secKeyVerify(candidate)` (from `libsecp256k1` via ACINQ’s `secp256k1-kmp-jni-android` library) - Retry loop (max 8) in the astronomically unlikely event that the 32 bytes fall outside the valid range, with invalid candidates set to zero (`candidate.fill(0)`) - The first valid candidate is then stored using `KeyStorage.store()` (encrypted with AES-256GCM), and the public key is derived using `SchnorrSigner.getPublicKey()` On virtually all recent Android SoCs (up to 4–5 years old), `/dev/urandom` is sourced from: - Hardware clocks - The SoC’s TRNG (True Random Number Generator, using various sources like RF noise, etc) - And for low-end or older SoCs that do not have a TRNG, the entropy comes from scheduler jitter, interrupt timing and I/O hw responses, which remains cryptographically adequate, except perhaps immediately after power-on. View article → However, Coldcard’s experience shows that it is important to have a mechanism for verifying entropy quality that is as thorough as possible. That is why we are working on adding a TRNG detection and multi-source mixing mechanism that will be included in a release in the coming weeks. #SISTR #CustID #did #sovereign
Fabio Bonfiglio's avatar
Fabio Bonfiglio 2 months ago
I’m absolutely loving this! The C64 was my very first computer and my first experience of programming. It’s amazing to see the brand getting involved in the fight against digital surveillance! 🔥 View quoted note →
Fabio Bonfiglio's avatar
Fabio Bonfiglio 2 months ago
Next week I will be preparing the first (beta) release of the CustID signer app (on Zapstore hopefully). 📲 In the meanwhile, please share and/or give me feedback about #SISTR (see note below) 🙏 View quoted note →
Fabio Bonfiglio's avatar
Fabio Bonfiglio 2 months ago
After years of designing DAOs, one thing became clear: identity is the root of all sovereignty. So, in the past few months, I started to work on SISTR: Sovereign Interactions Stack for Trustless Relationships. Identities made to be portable and real, usable online AND in the physical world. It’s simple conventions on top of Nostr + ongoing R&D for ZKPs. Please explore it, including the reference implementations (a mobile, NIP-46 capable, Identity wallet will be released soon™), here:
SISTR — Sovereign Interactions Stack for Trustless Relationships
SISTR is an open protocol built on Nostr that brings sovereign, offline-capable identity proofs, structured credentials and privacy-preserving zero...
 And lease challenge it ! Your feedbacks would be greatly appreciated. 🙏 #sistr #nostr #did #selfsovereign
↑