Comment by JonathanBeuys | Hacker News Reader

Comment by JonathanBeuys | Hacker News Reader

Since I recently tried Nostr, I am much less worried what goes on with Twitter and Co. Nostr is crazy cool and feels a lot like it could become the future of publishing.

I basically just started posting on the first random client I found on Google (iris.to) and ... it works:

https://iris.to/npub14cxhrehjln8r4fqgc8uvatkjv5dlwzxvua2ym93...

No signup, no decision to make which host to use, no nothing. Just save the private key (which iris.to creates for you) and you are good to go forever. The content you post gets relayed everywhere:

https://snort.social/p/npub14cxhrehjln8r4fqgc8uvatkjv5dlwzxv...

So it does not matter if the client you used changes their policies, their algorithm, deplatforms you, goes down or whatever. You can just use any other client and keep posting.

And since the protocol is using websockets, one can write a client in a static html page without any server backend. And it needs surprisingly little code to do so. I really enjoyed this video of a guy writing a Nostr client in a simple html file with like 50 lines of code or so:

https://www.youtube.com/watch?v=HbicnlCXg_Y

> “Just save the private key”

A massive usability hurdle for any hope of mainstream adoption.

People say Mastodon is hard to join because you have to pick a server. It’s on another level if you also have to pick a service to hold your private key, and you can lose your account if you don’t do this.

I just marked the key with my mouse, pressed ctrl+c, went to a text file, pressed ctrl+v and saved it.

If someone is not capable of doing that, I am not sure I want to read their articles.

Not sure what you are referring to with "pick a service to hold your private key". The whole point of Nostr is that you don't need any service to hold anything for you.

It's actually a little more complex than that. Many people go through computers several times between moving to each new social network. You have to also A) print and store the key (yikes), B) make sure you move the file to the new computer (easy now with migration assistance) or C) make sure you are backing up your computer (a lot less people use backups than should).

How is that different from passwords, exactly? Okay, maybe you can remember the passwords for services you use on a daily basis, but I must have a couple of hundred passwords to deal with, at least. Password managers can help with the data overload, but only at the cost of introducing the same single point of failure as a private key, and arguably a less-secure one.

You can use the "forgot password" dialog for passwords.

It’s not different from just a password. That’s why no service uses an unrecoverable password as the only authentication mechanism because it would be a terrible usability and security problem.

Ordinary people expect to be able to reset forgotten passwords. And because people are bad at managing passwords, reasonable services try to get them to use 2FA so their accounts wouldn’t get stolen. A service that uses plain private keys has both problems.

> it would be a terrible usability and security problem.

Compared to, say, someone being able to compromise every account you have because you walked away from your desktop or phone while logged into email?

Just email the private key to yourself, or store in your password manager for hacker types.

In addition to the other points, "regular users" unfortunately still quite often use only a few passwords, shared between all their services. So only 3-4 passwords (and variations) to remember!

I don't know anybody who has no data they care for.

Everybody has some data they never don't want to lose.

So the Nostr key would be just another piece of such data.

Also, losing it would not that much of a desaster. Use a new key, and let people know about it via other channels.

And if your private key is compromised?

And if your password is compromised?

There's no reason you need to use the same private key for every service, any more than you need to use the same password for every service.

If your password is compromised, you start the password reset procedure the service in question provides.

Post a couple of times that the account is not to be trusted anymore and that people should check your HN account / Twitter / FB / Website to see your new account.

In contrast to Twitter & Co, a compromised account does not mean you cannot post anymore.

> Not sure what you are referring to with "pick a service to hold your private key". The whole point of Nostr is that you don't need any service to hold anything for you.

Serious question: Didn't the cryptocurrency people say the same thing? Look how that went -- the tech nerds tended to do it "right," and the non-tech-nerds tended to use exchanges-or-similar that were a bit less than stable, to say the least. Am I misunderstanding?

Your comment reads exactly inverse of the original dropbox comment, sure you can Ctrl+c and ctrl+v in a text file. How are you securing it and why, what does it do. Why do I have to open a text editor, to create an account. Sure I can rsync or host my files on sftp, but there is a reason why Dropbox got more popular than any of those among avg users.

A key is pretty similar to a password. "Avg users" use passwords all the time.

But my post wasn't even about average users. The majority of people never publish anything.

> A massive usability hurdle for any hope of mainstream adoption.

Compared to managing passwords, screwing around with authorization codes sent by email and/or text message, and all the other folderol associated with that model?

All the folderol exists so that ordinary people don’t lose their accounts permanently when they inevitably forget a password.

With just a private key, no such protection. Unless you take active steps to store the key safely, you’re a few Backspace key presses away from losing your account forever (or at the other end, having it stolen if you leave the key lying around).

Reply on news.ycombinator.com