Damus
Alan profile picture
Alan
@CJack60

They're in the walls

npub142wsqasg76pa45cnq6c425add37r9h3jnskayyu90y5tsguzyjts8rnfw6@npub.cashlnurl
Relays (6)
  • ws://oxtrdevav64z64yb7x6rjg4ntzqjhedm5b5zjqulugknhzr46ny2qbad.onion/ – read & write
  • ws://rm654uy2snaq45ew5wd2nagsnznmjgkl2b4bz2nrf7trqlqqj4erhdid.onion/ – read & write
  • wss://nostr.bitcoiner.social/ – read & write
  • wss://nostr.mom/ – read & write
  • wss://nos.lol/ – read & write
  • wss://relay.damus.io/ – read & write

Recent Notes

Vitor Pamplona · 2w
Sure, but malwares are not detected right away, it takes a long time. So while you are running the malware can see your messages before you delete them.
Vitor Pamplona · 2w
How did it leak? Amber is super small, we can review the entire code in a couple hours if the problem was there.
Alan profile picture
Why not use Amber to store my bitcoin? If it is so secure? Well, because maybe at some point the device itself isn't secure.
I don't care because I use Signal with disappearing messages. If/When my device gets hacked, hopefully the hack left some trace or strange behavior that I pick up on. If it doesn't then it was probability very sophisticated. Most zero days leave traces.
Vitor Pamplona · 2w
If your device gets hacked, nothing can protect your messages... No matter how advanced their encryption is. If that is your thread model, you don't even need to encrypt anything because it is all irrelevant at that point.
Vitor Pamplona · 2w
How did it leak? Amber is super small, we can review the entire code in a couple hours if the problem was there.
Alan profile picture
I am not 100% sure if it leaked. All I know is something 'liked' a post in Amethyst that I did not recognize doing myself. And Amber was acting super buggy on my phone. It would pop up every time I try to use it. It was a huge pain just to post that my nsec got leaked. Then I wiped my phone for good measure. Amber is asynchronous so everything is a callback. I still use it, but I also swap out my nsec for fresh for privacy too. So at this point, I don't care if I loose my nsec. The PM messages would be nice to use but I don't use PMs for obvious reasons. I only use marmot or signal.
1
mleku · 2w
i wonder how many of the leaked nsecs were used with amber.
Vitor Pamplona · 2w
How did it leak? Amber is super small, we can review the entire code in a couple hours if the problem was there.
Vitor Pamplona · 2w
That's why we have signers. We don't move our nsecs around just like you wouldn't move your Marmot keys around.
Vitor Pamplona · 2w
Forward secrecy in signal is a lie exactly because you can export/import stuff or connect with a desktop app. I don't need your keys, I just need to connect my desktop to your signal app. Then puf.. a...
Alan profile picture
I assume it copies it directly from what exists in storage on my phone. If true then your statement assumes the implemented solution assumes actual perfect forward secrecy. I mean, if it was truly perfect forward secrecy than I couldn't write the messages down on paper as I get them and share with a friend.
1
mleku · 2w
the forward secrecy is in the encrypted form not the message it contains.
Vitor Pamplona · 2w
Sure.. I find the use of "forward secrecy" terms just marketing bullshit most actual engineers know it only exist in theory. So, to me, that is not a good sales point for Marmot. I do like the scaling of group sizes, though... But I wouldn't use it because of "forward secrecy"...
Vitor Pamplona · 2w
That's a deal breaker for me. Either offer interoperability or GFO. Otherwise this is just another vendor-lock in scheme to block people from moving away from a company's products. MLS is mostly a co...
Alan profile picture
Which explains why it doesn't exist in Amethyst. Marmot is an upgrade from Signal to make it decentralized. Signal has a feature (perfect forward secrecy). The way they work around that is linking a device from the main account, and offering to copy historical messages to the linked device. If the feature you want doesn't exist in Signal, it probably will never exist in marmot. Of course don't quote me on anything. I am barely a spectator in this space. I have just been burned by Signal's centralization so I prefer marmot.
Vitor Pamplona · 2w
Forward secrecy in signal is a lie exactly because you can export/import stuff or connect with a desktop app. I don't need your keys, I just need to connect my desktop to your signal app. Then puf.. all the "perfect forward secrecy" turns into theoretical BS.
Vitor Pamplona · 2w
That's a deal breaker for me. Either offer interoperability or GFO. Otherwise this is just another vendor-lock in scheme to block people from moving away from a company's products. MLS is mostly a corporate play, so I am not surprised they have successfully brainwashed folks to think that is a feat...
Vitor Pamplona · 2w
Now open this chat on another Marmot based client to see what happens.
Lysergic4cid · 1w
you should hear white noise in white noise
mleku · 1w
what interests me is the protocol how you migrate a chat from 2 to 3 parties. it's obviously some kind of rollover process where last step forms the foundation of the state transition. i'm trying to think of where i have seen this pattern before. oh yes, pBFT validator lists. that problem is already...