ava on Nostr: Amber, especially its offline APK, is likely more secure against session hijacking ...

Amber, especially its offline APK, is likely more secure against session hijacking than nsec app. As a native Android app with offline capability, it sidesteps many network-based vulnerabilities. Nsec app, being web-based, is potentially more exposed to session hijacking risks.

I assume basics are being followed like:

- Using HTTPS to encrypt communication and prevent sniffing.
- Implementing proper session management, including secure session ID generation and handling.
- Using additional security measures like IP binding or user agent checking.
- Regularly expiring and regenerating session IDs

That said, we'd need to hear directly from the devs about specific safeguards. Even then, the only way to know definitively if the implementation is solid is through a successful exploit, or a thorough independent security audit.

Security audits are expensive and basically everything built on and for Nostr is still in beta, but like password managers, security audits are ultimately necessary for greater trust and certainty especially with everything that gets attached to a user's npub, and to my knowledge, neither has undergone or passed such an audit yet.

I personally use Amber for its offline capabilities and potential security advantages. However, always download from trusted sources and stay cautious, especially on shared networks.

greenart7c3 (nprofile…fpck)

brugeman (nprofile…kdah)

Any input on this would be appreciated. Thank you.