Why Nostr? What is Njump?
2023-06-04 17:02:31
in reply to

shafemtol on Nostr: I'd be uneasy about a supposed "shared secret" being put in a public `p` tag. Indeed, ...

I'd be uneasy about a supposed "shared secret" being put in a public `p` tag.

Indeed, AIUI, using a silent inbox as presented here completely breaks the security of any past and future regular NIP-04 DMs between the same parties, because the same "shared secret" used for encryption in regular NIP-04 DMs is being used publicly in the silent inbox. An attacker doing trial and error decryption of NIP-04 DMs would be able to decrypt all regular DMs between the two, as well as deanonymize the silent inbox.
Author Public Key
npub1mh94j7j7nwvzl7kwcg70fhxe67kdy50fccakmueq9jjf77zmc25svanahj