I don't know.. everything feels so easily hackable when stakes are high...
We could also not use bitcoin at all and keep the company's relay url in the expiration token. The relay url becomes the source of truth because it is controlled by the company. Clients just need to check the delegation authority written in replaceable events in that relay. In that way, we bake the "how to find the most up-to-date authorization replaceable" into the delegation token.
Kinda similar to a nostr-native NIP-05. The delegation is checked every time the post is displayed.
But I trully think a better solution is a hardware signer that the company can write an nsec into it and the user can never take it out or copy. Company could buy a few of those and hand them away. The signer connects to the company's system to check the expiration every time it signs. Once the company removes authorization, the device becomes a paperweight.
Vitor Pamplona
npub1gc…fnj5z
2024-07-10 16:59:26
in reply to nevent1q…3nfa
Author Public Key
npub1gcxzte5zlkncx26j68ez60fzkvtkm9e0vrwdcvsjakxf9mu9qewqlfnj5zSeen on
wss://nostr.oxtr.devwss://relay.noswhere.comwss://nostr.winewss://relay.nostr.bandwss://vitor.nostr1.comwss://relay.damus.ioPublished at
2024-07-10 16:59:26Event JSON
{
"id": "0601df510180d7bf6dd5e2727adbdc4ce727809858080df6e5db1447a6c0dde3",
"pubkey": "460c25e682fda7832b52d1f22d3d22b3176d972f60dcdc3212ed8c92ef85065c",
"created_at": 1720630766,
"kind": 1,
"tags": [
[
"e",
"e6b9938568422700568944318b028106e698534b3549f2b670c9cb5ca534b929",
"",
"root"
],
[
"e",
"c55b4b62307ab9e8943f8f62dba02863d08688388d3fdf71a8d4d7f32f462ea7"
],
[
"e",
"ac514af2d298ea600db716d2844a925b65a0a9100123148d041000c728d8e9e9",
"",
"reply"
],
[
"p",
"6e468422dfb74a5738702a8823b9b28168abab8655faacb6853cd0ee15deee93"
],
[
"p",
"460c25e682fda7832b52d1f22d3d22b3176d972f60dcdc3212ed8c92ef85065c"
]
],
"content": "I don't know.. everything feels so easily hackable when stakes are high... \n\nWe could also not use bitcoin at all and keep the company's relay url in the expiration token. The relay url becomes the source of truth because it is controlled by the company. Clients just need to check the delegation authority written in replaceable events in that relay. In that way, we bake the \"how to find the most up-to-date authorization replaceable\" into the delegation token.\n\nKinda similar to a nostr-native NIP-05. The delegation is checked every time the post is displayed. \n\nBut I trully think a better solution is a hardware signer that the company can write an nsec into it and the user can never take it out or copy. Company could buy a few of those and hand them away. The signer connects to the company's system to check the expiration every time it signs. Once the company removes authorization, the device becomes a paperweight.",
"sig": "c97db7ea0f0cfb1a8c01c269437a306db53c4aeb7bc10d0f2e26a44fc711a72b038e8ecd124c0f10252c84c609dbd07c51cef3919370a229778a68923f9f887e"
}