leon's avatar
leon
leon@hodl.ar
npub1gxdh...5zfk
courage is our own fountain of wisdom ๐ŸŒฑ https://quantakrypto.com
leon's avatar
leon 3 days ago
after the Coldcard weak keys issue and the recent HSM vulnerability, i think now more than ever we should make education and tools for safely generating seeds and private keys more accessible 100 dice rolls or 256 coin flips might sound excessive. it takes 5 to 10 minutes, but gives you something valuable: entropy you generate yourself, without having to trust a device's random number generator Nostr WoT helps you create your seed phrase using real dice rolls or coin flips, with a transparent process you can verify - Video: - Guide: - Extension: any feedback or ideas welcome, especially from people who already roll their own seeds image
leon's avatar
leon 4 days ago
iโ€™ve been exploring different ways to make creating a Nostr account easier. a friend suggested passkeys, so I gave it a go. hereโ€™s how it turned out in Nostr WoT -- itโ€™s available to try, and thereโ€™s an SDK with interoperability docs if you want to build on it - setup and recovery guide: - chrome: https://chromewebstore.google.com/detail/nostr-wot/gfmefgdkmjpjinecjchlangpamhclhdo - firefox: would love some feedback. does this feel easier? what would you change?
leon's avatar
leon 3 weeks ago
Iโ€™ve been working on Nostr WoT and put together some guides with screenshots and a YouTube playlist to walk through it. https://www.youtube.com/playlist?list=PLEmTf_Ex3n7c I am looking for honest and critical feedback. Iโ€™d especially like you to try the new permission controls: - Global rules, with overrides for individual sites. - Optional automatic backend authentication for matching origins and verified site/API pairs. - Relay authentication for specific apps or across all connected sites, so you donโ€™t keep approving the same relay. Does it make sense when you use it? Are the prompts clear? Anything annoying or missing? Give it a go with your usual Nostr client and let me know. Feedback on the guides and videos is welcome too. You can use it with Nostr Connect and Nostr Wallet Connect to get acquainted
leon's avatar
leon 1 month ago
i've been putting together an index of projects implementing or experimenting with post-quantum cryptography in Nostr: It covers encrypted messages, signatures and transport, with links to the code and an explanation of what each approach actually protects i'd love to see us converge on shared key discovery, formats and test vectors. there's working code to build on, though the NIP proposal is still open building something in this area, or know a project we're missing? send a link or open a PR. i'm happy to collaborate #pqc #postquantumnostr #postquantumcryptography #nostrwot
leon's avatar
leon 2 months ago
obelisk.ar DMs are post-quantum encrypted as of this week. keys come from the seed phrase you already have (or should create), messages ride inside ordinary NIP-17 gift wrap, and no relay had to change anything reading them needs no negotiation: the envelope says what it is. sending needs one cached relay query. for most clients this is an afternoon of work it is opt-in today because a Nostr identity is a secp256k1 key and nothing else, with no algorithm field. we already version NIP-44 payloads. the idea is in the protocol, it just has not reached the key formats are public drafts. argue with them before a second client ships against them View article โ†’
leon's avatar
leon 2 months ago
somebody is collecting your encrypted messages. storing them to read them 10 years from now. that's the whole attack. wake up View article โ†’
leon's avatar
leon 7 months ago
pretty clear breakdown, core argument is strong. relay-based filtering is the right structural incentive. the "tragedy of the commons" point is an angle that i had hard to imagine: if filtering is purely local, you're offloading the mess onto everyone visiting your threads. relay selection as social responsibility makes sense that said, want to push on something: what happens if we take the relay-filtering model seriously but ask what a "relay" could actually be? right now clients are dumb readers, relays are smart filters. users pick relays with good policies, system works because operators have infrastructure and incentives to filter well. pyramid, pow.relays.land, paid relays, all proof this works today but theres a gap. relay operators are a dependency surface, they decide whats stored, for how long, what rules apply. even the best-intentioned operator is a single point of policy. if inbox.yakihonne.com changes its algo or goes offline, every user with it as a read relay is affected part of why this felt inevitable is that clients used to be genuinely constrained. storage expensive, bandwidth metered, battery a real concern. making clients dumb made sense. but that assumption is aging, phones today have hundreds of gigs, always-on connections, processors that would've been server-grade not long ago. the gap between client and server is narrowing, even if the protocol still treats them as categorically diferent what if some clients started behaving more like relays? not replacing what you describe, complementing it. a client that forms bilateral storage agreements with wot peers, i store yours you store mine, with roughly matched volumes so neither side is freeloading. both sides have skin in the game which is what makes it stable, if you stop holding up your end i stop holding up mine and we both lose a storage partner the filtering part comes almost for free. content only propagates within a trust boundary, say 2-hop follows, so spam from throwaway keys never reaches you. not because a relay filtered it but because nobody in your social graph stored or forwarded it. same wot principle pyramid uses, distributed across participants instead of centralized in an operator the part that makes it not just a nice idea is how you actually find stuff without a relay index. you'd want something like a tiered approach, check local storage first, then try known peers who responded fast before, then fan out a blinded request through your wot if needed, and only hit traditional relays as a last resort. relays become a fallback layer rather than the primary path, which is basically embedding your model as a component the question is wether both models coexist and reinforce each other. relays handle filtering and inbox routing (works today, should be default), wot-based peer storage adds an availability layer and alternative discovery path that doesnt depend on any single operator. periodic challenge-response checks between partners keep the storage honest without needing anything as heavy as proof of work or staking curious if you see something structurally incompatible about the two coexisting, or if you thinkk the relay model already covers this ground
leon's avatar
leon 7 months ago
irony: censored in nostr-protocol github ๐Ÿ˜‡ image
leon's avatar
leon 8 months ago
hey David. every existing proposal has the same flaw: if an attacker has your nsec, they can publish the same migration event you can. you can't prove who did it. i am proposing below a scheme that fixes this using a hash commitment published on day one, a sha256 of a passphrase that lives only in your head (a password or something). attacker can't rotate without knowing it. if they try, the fraudulent rotation is cryptographically distinguishable from a legitimate one. key theft becomes detectable, not just disruptive. draft NIP: check it out, and let me know your thoughts! #nostrbuild #keyrotation #cryptography
leon's avatar
leon 8 months ago
just opened NIP-XX: ๐ฐ๐ข๐ง๐๐จ๐ฐ.๐ง๐จ๐ฌ๐ญ๐ซ.๐ฐ๐จ๐ญ โ€” a standard browser API for Web of Trust queries tired of every client reimplementing the same WoT logic, fetching follow lists independently, wasting bandwidth doing the same graph calculations. this proposes a shared interface exposed by browser extensions so any nostr web client can query trust distances, scores, and social graph data without reinventing the wheel. covers: ๐—ด๐—ฒ๐˜๐——๐—ถ๐˜€๐˜๐—ฎ๐—ป๐—ฐ๐—ฒ(), ๐—ถ๐˜€๐—œ๐—ป๐— ๐˜†๐—ช๐—ผ๐—ง(), ๐—ณ๐—ถ๐—น๐˜๐—ฒ๐—ฟ๐—•๐˜†๐—ช๐—ผ๐—ง() for trust-gating ๐—ด๐—ฒ๐˜๐—ง๐—ฟ๐˜‚๐˜€๐˜๐—ฆ๐—ฐ๐—ผ๐—ฟ๐—ฒ(), ๐—ด๐—ฒ๐˜๐——๐—ฒ๐˜๐—ฎ๐—ถ๐—น๐˜€(), ๐—ด๐—ฒ๐˜๐—ฃ๐—ฎ๐˜๐—ต() for scoring and graph inspection batch methods for feed filtering ๐—น๐—ผ๐—ฐ๐—ฎ๐—น / ๐—ฟ๐—ฒ๐—บ๐—ผ๐˜๐—ฒ / ๐—ต๐˜†๐—ฏ๐—ฟ๐—ถ๐—ฑ ๐—บ๐—ผ๐—ฑ๐—ฒ๐˜€ already implemented and live in the nostr-wot extension for Chrome and Firefox โ†’ proposal: feedback welcome, especially from client devs who've already built their own WoT logic and know where the pain points are #NostrBuild #WebOfTrust #WoT #NostrWoT #DecentralizedTrust #Wotathon
leon's avatar
leon 8 months ago
Built MappingBitcoin because the alternatives are incomplete, centralized, and couldn't keep up with reality. OpenStreetMap as the source of truth + Nostr for decentralized reviews and verification + Nostr WoT to ensure you trust on your own judgement. image Anyone can update OSM. Businesses can claim their profiles through email/domain verification and Nostr keys. The Web of Trust filters spam and validates legitimacy. No platform risk. No single point of failure. Just verifiable, community-maintained data about where Bitcoin actually flows. The infrastructure matters more than the count. Build systems that scale without you. #bitcoin #nostr #bitcoinmap #nostrbuild #weboftrust #mappingbitcoin
leon's avatar
leon 8 months ago
Centralized platforms tell you who to trust. You don't get to see how or why. ๐ˆ ๐›๐ฎ๐ข๐ฅ๐ญ ๐๐จ๐ฌ๐ญ๐ซ ๐–๐จ๐“ ๐›๐ž๐œ๐š๐ฎ๐ฌ๐ž ๐ฒ๐จ๐ฎ๐ซ ๐ง๐ž๐ญ๐ฐ๐จ๐ซ๐ค ๐ฌ๐ก๐จ๐ฎ๐ฅ๐ ๐ฐ๐จ๐ซ๐ค ๐Ÿ๐จ๐ซ ๐ฒ๐จ๐ฎ, ๐ง๐จ๐ญ ๐š๐ ๐š๐ข๐ง๐ฌ๐ญ ๐ฒ๐จ๐ฎ. Your follows anchor your trust. Their network extends it. Distance becomes signal. You set the thresholds. See the actual shape of your network. Control what reaches you. Own your filters. ๐๐จ๐ญ ๐ญ๐ก๐ž๐ข๐ซ ๐š๐ฅ๐ ๐จ๐ซ๐ข๐ญ๐ก๐ฆ. ๐˜๐จ๐ฎ๐ซ๐ฌ. ๐€ ๐›๐ซ๐จ๐ฐ๐ฌ๐ž๐ซ ๐ž๐ฑ๐ญ๐ž๐ง๐ฌ๐ข๐จ๐ง ๐ญ๐ก๐š๐ญ ๐ ๐ข๐ฏ๐ž๐ฌ ๐ฒ๐จ๐ฎ ๐›๐š๐œ๐ค ๐œ๐จ๐ง๐ญ๐ซ๐จ๐ฅ. #decentralizedtrust #wot #nostr #weboftrust #grownostr #decentralization #buildingonnostr
โ†‘