RebelOfBabylon on Nostr: Refresh token so you don't need to log in every 15 minutes (because session token ...
Refresh token so you don't need to log in every 15 minutes (because session token should not be long lived). There isn't much trusting to do with the ID provider. You have to trust that the software works. It's like using the "login with Google" or "login with Facebook" buttons. They also use OIDC. In those cases, you have to trust them with your personal info. With this nostr ID provider, you hold the personal info on your device. We can maybe have some sort of encryption scheme between the nostr app and your phone app to make sure the info doesn't leak in transit. And tbh so far nostr apps have asked for your name, username, maybe an email. You can always enter fake or burner info in your device app so that nostr ID provider gets nothing. Its a very low trust system IMO.
Published at
2024-07-05 19:23:14Event JSON
{
"id": "b47c200b1679a6b2a4c32362d870854066bbdea940efe079447d4b1367cb854f",
"pubkey": "d06e6018c1fcf7d80d4f18ae7ea669fa10f84389f95f6d1bdcea9727cb266c33",
"created_at": 1720207394,
"kind": 1,
"tags": [
[
"e",
"212702ad022b48985734091df754d09607997e2abece53003a88332bbe675d8c",
"",
"root"
],
[
"e",
"a88a1f843ceba64ec832d650b5390f9b629e3bccb4fb99475c22acebcf55e9fb"
],
[
"e",
"50d12b07e902262fc965effb011b9609e70347a5bf7107ea1ffcd3abc2cb70e1",
"",
"reply"
],
[
"p",
"d06e6018c1fcf7d80d4f18ae7ea669fa10f84389f95f6d1bdcea9727cb266c33"
],
[
"p",
"32e1827635450ebb3c5a7d12c1f8e7b2b514439ac10a67eef3d9fd9c5c68e245"
],
[
"p",
"52b4a076bcbbbdc3a1aefa3735816cf74993b1b8db202b01c883c58be7fad8bd"
]
],
"content": "Refresh token so you don't need to log in every 15 minutes (because session token should not be long lived). There isn't much trusting to do with the ID provider. You have to trust that the software works. It's like using the \"login with Google\" or \"login with Facebook\" buttons. They also use OIDC. In those cases, you have to trust them with your personal info. With this nostr ID provider, you hold the personal info on your device. We can maybe have some sort of encryption scheme between the nostr app and your phone app to make sure the info doesn't leak in transit. And tbh so far nostr apps have asked for your name, username, maybe an email. You can always enter fake or burner info in your device app so that nostr ID provider gets nothing. Its a very low trust system IMO.",
"sig": "2aca3781f3534b4ccf77afad4c91475a9d95187c440b52160dbb4cd21c452c604ababbe9e33ea16317cb0caf0a7c1ffd7e7c56a0713471ce494ded877f1b3d6b"
}
