If you use nos2x-fox as your Nostr signer in Firefox, make sure you're on 1.21.0. It closes two things worth knowing about.
While your PIN was cached after an unlock, any website could ask the extension for it and get it back in plain text. That PIN is what encrypts your private key at rest, so a page could walk away with the one secret between it and your key. I reported it privately and wrote the fix; it was also reported publicly as #68.
The second was found by daym. The extension used to inject its script into pages as <script src="moz-extension://<uuid>/…">. Firefox gives every extension a random UUID per install precisely so websites can't fingerprint you by the extensions you run, and that tag handed it to every site you visited: the same on each one, and surviving cleared cookies. It now loads as a MAIN-world content script, with nothing left in the page to read.
Nothing to do except update. Firefox normally does that for you; about:addons shows which version you have.
https://github.com/diegogurpegui/nos2x-fox/releases/tag/v1.21.0
Joey_NostrComments / Joey (NostrComments)
npub1ew…mds9e
2026-09-22 14:51:36 UTC
Author Public Key
npub1ewxm82gprxwkh9qznauyey6vwx62xetpsux3prnmddkyevasatgswmds9eSeen on
wss://nostr.momPublished at
2026-09-22 14:51:36 UTCEvent JSON
{
"id": "aede1e011118cba6c8606d0b09941d0c43d6d798d0463e0e15972d74e7a1a7c7",
"pubkey": "cb8db3a901199d6b94029f784c934c71b4a36561870d108e7b6b6c4cb3b0ead1",
"created_at": 1790088696,
"kind": 1,
"tags": [
[
"t",
"68"
]
],
"content": "If you use nos2x-fox as your Nostr signer in Firefox, make sure you're on 1.21.0. It closes two things worth knowing about.\n\nWhile your PIN was cached after an unlock, any website could ask the extension for it and get it back in plain text. That PIN is what encrypts your private key at rest, so a page could walk away with the one secret between it and your key. I reported it privately and wrote the fix; it was also reported publicly as #68.\n\nThe second was found by daym. The extension used to inject its script into pages as \u003cscript src=\"moz-extension://\u003cuuid\u003e/…\"\u003e. Firefox gives every extension a random UUID per install precisely so websites can't fingerprint you by the extensions you run, and that tag handed it to every site you visited: the same on each one, and surviving cleared cookies. It now loads as a MAIN-world content script, with nothing left in the page to read.\n\nNothing to do except update. Firefox normally does that for you; about:addons shows which version you have.\n\nhttps://github.com/diegogurpegui/nos2x-fox/releases/tag/v1.21.0",
"sig": "dbbdd105fdf4b94aabffebd8e4814cb456bae8dea1b03ec03536e1eb2985fcdc149ddd9426540be3065ecbaac24a274e21e8b26615d1beead8b23c2e3fcc41c2"
}