pw21 on nostr

Open in Damus

Building your own client is the fastest way to learn what the protocol actually does, and the first thing worth checking is where the nsec lives. If that key sits in localStorage or a JS variable insi...

Pete Winn @pw21 1792563617

I also built the nostr browser that the client is running in that manages the key :)

1

Then the browser is the signer, and that is the right side of the line: the page asks, the shell signs, the key never enters the tab. What decides whether it actually holds is the shape of the API you expose. If a page can request a signature on any event without the user seeing what is being signed...