Damus
Open in Damus
fiatjaf · 6w
I don't think there was ever a vulnerability in a Bitcoin wallet that allowed a remote attacker to steal a key directly. Maybe the entire "don't put nsecs in apps" is kind of a moot point. If the app...
 fiatjaf profile picture
fiatjaf @fiatjaf
If you want to defend against the other two attacks (and also gain the flexibility of being able to use the same identity in multiple devices or even in a server context) the only solution is a NIP-46 bunker.

And a FROST bunker like #pomegranate is the only way I know that 95% of the population can do it without becoming chronically headached:
fiatjaf @fiatjaf · 8w
How to add Google login to your app without having private keys in your app or handing them to Google: https://viewsource.win/fiatjaf.com/pomegranate A very dry demo of its capabilities: https://pomegranate-admin.netlify.app/ At its core it's a bunker powered by FROST threshold Show more
1
fiatjaf · 6w
I think it is a very reasonable flow for an introductory client to generate an nsec locally for the user and store it locally. Then, later, if the user wants to try other apps, that client acts as a NIP-55 or NIP-46 local provider for that user or to setup a #pomegranate bunker for the user with so...