Auth and privacy
Sometimes I see devs advocating for auth as a privacy feature. It isn’t. In fact, is the opposite, authentication means that the user must be identified and verified.
As far as I know, the only way to achieve privacy preserving auth is through blinded authentication schemes, which is not what we have in Nostr. NIP-42 involves the relay challenging you with an event that you must satisfy with a valid signature. This proves that you are the person controlling the key. This means, a log of this user requested this event at this time, and of course if you don't use a VPN or tor, this also involves your ip.
We could argue that users can use throwaway or ephemeral keys, but that doesn’t mean authentication itself provides privacy.
The next time you hear someone say that auth equals privacy, member this, it doesn’t.
Sometimes I see devs advocating for auth as a privacy feature. It isn’t. In fact, is the opposite, authentication means that the user must be identified and verified.
As far as I know, the only way to achieve privacy preserving auth is through blinded authentication schemes, which is not what we have in Nostr. NIP-42 involves the relay challenging you with an event that you must satisfy with a valid signature. This proves that you are the person controlling the key. This means, a log of this user requested this event at this time, and of course if you don't use a VPN or tor, this also involves your ip.
We could argue that users can use throwaway or ephemeral keys, but that doesn’t mean authentication itself provides privacy.
The next time you hear someone say that auth equals privacy, member this, it doesn’t.
133❤️3❤️1👍1💯1🖤1🤙1
