GM Nostr ICYMI: if you have someone’s new Wallet of Satoshi lightning address, you can look up all of their payments on Spark's transaction explorer 1) Request an invoice using the Lightning address 2) Paste the bolt11 invoice into 3) Scroll down to the 'Routing Info' entries, and copy the pubkey with the highest CLTV Expiry Delta 4) Paste that address into Alternatively, use this tool that @npub1u8ln...turz made here: As far as I can tell, this is not a strict requirement for Spark lightning address implementations, so I hope to see this change. At present, if you give someone your Spark address or node pubkey they *can* access your transaction history. Nonetheless, really disappointed to see WoS leave the USA only to return with something that has zero privacy. We can do better.

Replies (22)

CptKook's avatar
CptKook 2 months ago
It was probably a condition of their safe return. Sell out game retarded
I emailed them too (also spoke to Aaron) and was told that they had left the Spark address exposed in the public .well-known/lnurlp string for testing purposes and it was only removed right before the public release. He didn’t follow up when I tried to dig deeper on the invoice question.
The default behavior in the Breez SDK is not to expose the spark address in the bolt11, so you can't do what Evan showed above. However, since spark reuses addresses (currently), you can still apply stuff like timing attacks to discover the underlying address. This should be addressed soon by the spark team (they are switching to a dynamic address model).
Adam Simecka's avatar
Adam Simecka 2 months ago
If there is any code we have that may help with this, you are welcome to use it, since we don't use Spark.
↑