leon

after the Coldcard weak keys issue and the recent HSM vulnerability, i think now more than ever we should make education and tools for safely generating seeds and private keys more accessible

100 dice rolls or 256 coin flips might sound excessive. it takes 5 to 10 minutes, but gives you something valuable: entropy you generate yourself, without having to trust a device's random number generator

Nostr WoT helps you create your seed phrase using real dice rolls or coin flips, with a transparent process you can verify

• Video: https://youtu.be/N0Kg5gZs5Ak
• Guide: https://nostrwot.com/guides/create-recovery-phrase-with-dice
• Extension: https://nostrwot.com/download

any feedback or ideas welcome, especially from people who already roll their own seeds

i’ve been exploring different ways to make creating a Nostr account easier. a friend suggested passkeys, so I gave it a go. here’s how it turned out in Nostr WoT

--

it’s available to try, and there’s an SDK with interoperability docs if you want to build on it

• setup and recovery guide: https://nostrwot.com/guides/create-nostr-account-with-passkey

• chrome: https://chromewebstore.google.com/detail/nostr-wot/gfmefgdkmjpjinecjchlangpamhclhdo

• firefox: https://addons.mozilla.org/es-AR/firefox/addon/nostr-wot-extension/

would love some feedback. does this feel easier? what would you change?

I’ve been working on Nostr WoT and put together some guides with screenshots and a YouTube playlist to walk through it.

https://www.youtube.com/playlist?list=PLEmTf_Ex3n7c

I am looking for honest and critical feedback. I’d especially like you to try the new permission controls:

• Global rules, with overrides for individual sites.
• Optional automatic backend authentication for matching origins and verified site/API pairs.
• Relay authentication for specific apps or across all connected sites, so you don’t keep approving the same relay.

Does it make sense when you use it? Are the prompts clear? Anything annoying or missing?

Give it a go with your usual Nostr client and let me know. Feedback on the guides and videos is welcome too.

You can use it with Nostr Connect and Nostr Wallet Connect to get acquainted

https://nostr-wot.com/download

https://nostr-wot.com/guides

i've been putting together an index of projects implementing or experimenting with post-quantum cryptography in Nostr:

https://github.com/nostr-wot/nostr-pqc#projects

It covers encrypted messages, signatures and transport, with links to the code and an explanation of what each approach actually protects

i'd love to see us converge on shared key discovery, formats and test vectors. there's working code to build on, though the NIP proposal is still open

building something in this area, or know a project we're missing? send a link or open a PR. i'm happy to collaborate

https://nostr-wot.com/pqc

#pqc #postquantumnostr #postquantumcryptography #nostrwot

obelisk.ar DMs are post-quantum encrypted as of this week. keys come from the seed phrase you already have (or should create), messages ride inside ordinary NIP-17 gift wrap, and no relay had to change anything

reading them needs no negotiation: the envelope says what it is. sending needs one cached relay query. for most clients this is an afternoon of work

it is opt-in today because a Nostr identity is a secp256k1 key and nothing else, with no algorithm field. we already version NIP-44 payloads. the idea is in the protocol, it just has not reached the key

formats are public drafts. argue with them before a second client ships against them

https://quantakrypto.com/blog/obelisk-first-nostr-client-post-quantum-dms

somebody is collecting your encrypted messages. storing them to read them 10 years from now. that's the whole attack. wake up

just launched Nostr Widgets, server-rendered svg widgets for Nostr profiles, follows, and feeds to embed with in static pages, thoughts?

https://github.com/nostr-wot/nostr-widgets

set up your ligthning wallet with 2 clicks

https://nostr-wot.com/guides/lightning-address

pretty clear breakdown, core argument is strong. relay-based filtering is the right structural incentive. the "tragedy of the commons" point is an angle that i had hard to imagine: if filtering is purely local, you're offloading the mess onto everyone visiting your threads. relay selection as social responsibility makes sense

that said, want to push on something: what happens if we take the relay-filtering model seriously but ask what a "relay" could actually be?

right now clients are dumb readers, relays are smart filters. users pick relays with good policies, system works because operators have infrastructure and incentives to filter well. pyramid, pow.relays.land, paid relays, all proof this works today

but theres a gap. relay operators are a dependency surface, they decide whats stored, for how long, what rules apply. even the best-intentioned operator is a single point of policy. if inbox.yakihonne.com changes its algo or goes offline, every user with it as a read relay is affected

part of why this felt inevitable is that clients used to be genuinely constrained. storage expensive, bandwidth metered, battery a real concern. making clients dumb made sense. but that assumption is aging, phones today have hundreds of gigs, always-on connections, processors that would've been server-grade not long ago. the gap between client and server is narrowing, even if the protocol still treats them as categorically diferent

what if some clients started behaving more like relays? not replacing what you describe, complementing it. a client that forms bilateral storage agreements with wot peers, i store yours you store mine, with roughly matched volumes so neither side is freeloading. both sides have skin in the game which is what makes it stable, if you stop holding up your end i stop holding up mine and we both lose a storage partner

the filtering part comes almost for free. content only propagates within a trust boundary, say 2-hop follows, so spam from throwaway keys never reaches you. not because a relay filtered it but because nobody in your social graph stored or forwarded it. same wot principle pyramid uses, distributed across participants instead of centralized in an operator

the part that makes it not just a nice idea is how you actually find stuff without a relay index. you'd want something like a tiered approach, check local storage first, then try known peers who responded fast before, then fan out a blinded request through your wot if needed, and only hit traditional relays as a last resort. relays become a fallback layer rather than the primary path, which is basically embedding your model as a component

the question is wether both models coexist and reinforce each other. relays handle filtering and inbox routing (works today, should be default), wot-based peer storage adds an availability layer and alternative discovery path that doesnt depend on any single operator. periodic challenge-response checks between partners keep the storage honest without needing anything as heavy as proof of work or staking

curious if you see something structurally incompatible about the two coexisting, or if you thinkk the relay model already covers this ground

irony: censored in nostr-protocol github 😇

GrapheneOS partnering with Motorola is the kind of news that we should all be pushing for

privacy-grade OS. mass-market hardware. no compromises

this is how you bring sovereignty to not-power-users, not by preaching, but 𝐛𝐲 𝐦𝐚𝐤𝐢𝐧𝐠 𝐭𝐡𝐞 𝐬𝐞𝐜𝐮𝐫𝐞 𝐨𝐩𝐭𝐢𝐨𝐧 𝐭𝐡𝐞 𝐝𝐞𝐟𝐚𝐮𝐥𝐭 𝐨𝐧𝐞.

#grapheneos #privacy

hey David. every existing proposal has the same flaw: if an attacker has your nsec, they can publish the same migration event you can. you can't prove who did it.

i am proposing below a scheme that fixes this using a hash commitment published on day one, a sha256 of a passphrase that lives only in your head (a password or something).

attacker can't rotate without knowing it. if they try, the fraudulent rotation is cryptographically distinguishable from a legitimate one.

key theft becomes detectable, not just disruptive.

draft NIP: https://github.com/nostr-protocol/nips/issues/2237

check it out, and let me know your thoughts!

#nostrbuild #keyrotation #cryptography

just opened NIP-XX: 𝐰𝐢𝐧𝐝𝐨𝐰.𝐧𝐨𝐬𝐭𝐫.𝐰𝐨𝐭 — a standard browser API for Web of Trust queries

tired of every client reimplementing the same WoT logic, fetching follow lists independently, wasting bandwidth doing the same graph calculations. this proposes a shared interface exposed by browser extensions so any nostr web client can query trust distances, scores, and social graph data without reinventing the wheel. covers:

𝗴𝗲𝘁𝗗𝗶𝘀𝘁𝗮𝗻𝗰𝗲(), 𝗶𝘀𝗜𝗻𝗠𝘆𝗪𝗼𝗧(), 𝗳𝗶𝗹𝘁𝗲𝗿𝗕𝘆𝗪𝗼𝗧() for trust-gating

𝗴𝗲𝘁𝗧𝗿𝘂𝘀𝘁𝗦𝗰𝗼𝗿𝗲(), 𝗴𝗲𝘁𝗗𝗲𝘁𝗮𝗶𝗹𝘀(), 𝗴𝗲𝘁𝗣𝗮𝘁𝗵() for scoring and graph inspection batch methods for feed filtering

𝗹𝗼𝗰𝗮𝗹 / 𝗿𝗲𝗺𝗼𝘁𝗲 / 𝗵𝘆𝗯𝗿𝗶𝗱 𝗺𝗼𝗱𝗲𝘀

already implemented and live in the nostr-wot extension for Chrome and Firefox → https://nostr-wot.com/download

proposal: https://github.com/nostr-protocol/nips/issues/2236

feedback welcome, especially from client devs who've already built their own WoT logic and know where the pain points are

#NostrBuild #WebOfTrust #WoT #NostrWoT #DecentralizedTrust #Wotathon

Built MappingBitcoin because the alternatives are incomplete, centralized, and couldn't keep up with reality.

OpenStreetMap as the source of truth + Nostr for decentralized reviews and verification + Nostr WoT to ensure you trust on your own judgement.

https://blossom.primal.net/5773c3c557a46a9db149a67591b7abf4779109088e54fd330dcaadfa6ff4fbd2.png Anyone can update OSM. Businesses can claim their profiles through email/domain verification and Nostr keys. The Web of Trust filters spam and validates legitimacy.

No platform risk. No single point of failure. Just verifiable, community-maintained data about where Bitcoin actually flows.

The infrastructure matters more than the count. Build systems that scale without you.

https://mappingbitcoin.com

#bitcoin #nostr #bitcoinmap #nostrbuild #weboftrust #mappingbitcoin

Centralized platforms tell you who to trust. You don't get to see how or why.

𝐈 𝐛𝐮𝐢𝐥𝐭 𝐍𝐨𝐬𝐭𝐫 𝐖𝐨𝐓 𝐛𝐞𝐜𝐚𝐮𝐬𝐞 𝐲𝐨𝐮𝐫 𝐧𝐞𝐭𝐰𝐨𝐫𝐤 𝐬𝐡𝐨𝐮𝐥𝐝 𝐰𝐨𝐫𝐤 𝐟𝐨𝐫 𝐲𝐨𝐮, 𝐧𝐨𝐭 𝐚𝐠𝐚𝐢𝐧𝐬𝐭 𝐲𝐨𝐮.

Your follows anchor your trust. Their network extends it. Distance becomes signal. You set the thresholds.

See the actual shape of your network. Control what reaches you. Own your filters.

𝐍𝐨𝐭 𝐭𝐡𝐞𝐢𝐫 𝐚𝐥𝐠𝐨𝐫𝐢𝐭𝐡𝐦. 𝐘𝐨𝐮𝐫𝐬.

https://nostr-wot.com/

https://nostr-wot.com/playground

𝐀 𝐛𝐫𝐨𝐰𝐬𝐞𝐫 𝐞𝐱𝐭𝐞𝐧𝐬𝐢𝐨𝐧 𝐭𝐡𝐚𝐭 𝐠𝐢𝐯𝐞𝐬 𝐲𝐨𝐮 𝐛𝐚𝐜𝐤 𝐜𝐨𝐧𝐭𝐫𝐨𝐥.

#decentralizedtrust #wot #nostr #weboftrust #grownostr #decentralization #buildingonnostr