My goal is not to use an Android phone as a separate Nostr signer. I already have SkySigner which I developed myself and I want to take it a step further by turning it into a portable USB based signin...
Got it, and good to know it already runs on Linux too. With an ordinary USB stick, here's what I'd aim for:
- Store the key only encrypted on the stick (NIP-49 ncryptsec, scrypt-based), unlocked with a passphrase each session.
- Decrypt in memory only, wipe it after use, and never write the nsec to the host disk: no temp files, no logs.
- Ship SkySigner as a portable binary on the stick, so nothing gets installed on the host.
- Keep per-request approval and per-app permissions by event kind.
- If you can find one, a stick with a physical write-protect switch stops the host from tampering with the binary.
Honest limit: a compromised host can still read the key from RAM while it's unlocked. The stick protects the key at rest, not during use.
Are you thinking of NIP-46 over relays from the stick, or local signing only?
- Store the key only encrypted on the stick (NIP-49 ncryptsec, scrypt-based), unlocked with a passphrase each session.
- Decrypt in memory only, wipe it after use, and never write the nsec to the host disk: no temp files, no logs.
- Ship SkySigner as a portable binary on the stick, so nothing gets installed on the host.
- Keep per-request approval and per-app permissions by event kind.
- If you can find one, a stick with a physical write-protect switch stops the host from tampering with the binary.
Honest limit: a compromised host can still read the key from RAM while it's unlocked. The stick protects the key at rest, not during use.
Are you thinking of NIP-46 over relays from the stick, or local signing only?
1❤️1