Egge @Egge - 1y
OTP login coming to npub.cash 🔥 https://m.primal.net/NUgP.png
No, it's basically SMS 2FA, but on nostr. You enter your npub on the login screen and receive an OTP via NIP17 DM
jimbocoin 🃏 @jimbocoin - 1y
Did NIP42 auth not suffice for this use case?
No, the problem with NIP-07, NIP-46 and NIP-42 is that all of them require signatures. Requiring a signature comes with the burden of key-management. Either your app accesses keys directly (unsafe) or you use a signer / extension (friction). With this using npub.cash becomes as easy as operating a single nostr client. No additional software required. NIP-46 and NIP-07 logins are still possible. OTP is not mandatory, but complimentary
In order to decrypt the DM, the client must have control of the private key. But yes, they don’t have to sign anything—just prove that they have the private key to decrypt the DM. I guess the question is whether your service wants to run its own relay. If you’re running your own relay, the client *should* automatically respond to a NIP42 auth request transparently without the user having to do anything. If you’re not running your own relay, then NIP42 connection-level auth won’t help you.
This is not the point. Adding OTP enables apps that do not have access to your private key to still implement npub.cash's API. Imagine you want to use cashu.me with npub.cash, but you don't have a signing extension. Instead of pasting your private key in there you could simply: 1. Add you public key to cashu.me 2. Go to your daily driver nostr app 3. Retrieve the OTP and paste it into cashu.me 4. Cashu.me is now authenticated with npub.cash without ever signing anything, nor accessing the keys
Got it, I see. Then one thing I would recommend is to consider allowing the user to just respond via DM. “OK” to continue or something. The daily driver must have their private key in some form to be able to decrypt the DM. OTP still has the feature that the user didn’t have to sign anything, however.
