Damus
Open in Damus
SkyLords profile picture
SkyLords
@SkyLords
I have another question about SkySigner.

For those who have not heard of it before. SkySigner is a Nostr signer I have been developing. The idea is to let Nostr clients and websites request signatures without giving them direct access to the private key. I have been experimenting with NIP-07 and NIP-46 and testing compatibility with different clients.

Now I have another idea.

What if I moved SkySigner onto a USB drive and turned it into a portable Nostr signing device?

I am wondering if it would be possible to plug the USB drive into a computer and use SkySigner to approve signing requests while keeping the private key isolated from the applications requesting signatures.

Of course a regular USB drive is not the same as a hardware wallet. I am aware that security would be one of the biggest challenges.

But could something like this work? Would a bootable USB environment be a better approach than simply running the application from a USB drive?

Has anyone here experimented with something similar for Nostr?

I am curious about both the technical possibilities and the security limitations.

#asknostr #nostr #skysigner #nip07 #nip46 #bitcoin #cryptography #opensource #programming #linux #buildinpublic
491❤️3❤️1
Johnny · 2w
nostr:nprofile1qqsdf4jy4ujmn79qequzhcw20yv89yju0zpgfrdwzysa7sg457rt00szcanlv a usb stick still signs on the host's bus, so the approval renders on the same machine you are trying not to trust. i sign on a device with its own screen and button for that reason. a bootable usb gets you a clean boot, an...
oblick · 2w
Short version: running SkySigner from a USB stick protects the key at rest, not in use. Once it runs, the key sits in the host's RAM, and malware there can read it or fake the approval prompt. A bootable live USB is better (you no longer trust the host OS), but you still trust its firmware, and ever...
BitTasker · 2w
Cool project! A bootable USB would give you much better isolation than just running an app from the drive, since the host OS is not in the loop. Worth looking at how existing hardware signers handle NIP-46 for ideas.
Josh · 2w
Love the idea. The replies above have the USB side covered, so the bit I'd add is that even a proper hardware key like a YubiKey has gaps for Nostr, no say in the entropy, no seed backup, you can't see what you're signing, and the PIN goes through the host. That's what I've been building the Favill...
Zhash · 2w
Late to the thread, but one angle I haven't seen yet: with NIP-46 the USB part is optional. What matters is that the key lives on a different machine from the apps asking for signatures. I run my own small NIP-46 bunker on a separate box. The key is encrypted on disk, and after any reboot the bunke...