2023-12-04T13:05:35Z https://njump.cloud.vinney.xyz Deleted Account https://njump.cloud.vinney.xyz/npub1ehg5cqekjlj2jqqhc7z9y2sjq4am42dntahcyn225twv9xdu2m2sl5qe5t https://njump.cloud.vinney.xyz/nevent1qqs07xe6f257dazqwk374d02r9a56frnjxf6ha60cqe3mytaclr922qzyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td2nts9lu <blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/note1maafh0nk7ytned6twcw7aq04svuhmxu609pf3wwu9l9r50r4clvqhjf8st" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">note1maa…f8st</a></span><br/> </div> <h1 id="summary-2">Summary</h1> <p>A user lost 180,000 sats due to a series of unfortunate events involving nostr clients, user error, lack of validation checks, lack of key rotation or mitigation approaches.</p> <h1 id="what-happened-2">What happened</h1> <p>On Saturday 2023 December 2, a user had their profile set to a zeuspay address. Zeuspay addresses are not readily zappable as the receiver needs to acknowledge each zap sent to them. A request was made that they change their lightning address.</p> <p>The user chose to change to the getalby address that they had previously setup. After entering an older incorrect value, they went to update their profile, but then managed to accidentally post their LND Wallet connection string instead.</p> <p>A fellow nostrich realized their mistake and informed them. The user began setting up a stacker.news account, while helper connected via bluewallet using the connection string and moved funds out. Helper noted to user that the alby account can&#39;t create a separate wallet per account or rotate to new wallet and in order to continue using getalby, they would need to establish an entirely new alby account with a different email. The funds were sent from helper to user&#39;s new stacker.news account.</p> <p>After this, the user linked their stacker.news account with the alby account having the compromised wallet. The user moved some funds to a different account. Later, after going to sleep, the user found remaining funds were pulled from their stacker.news account. It&#39;s believed that Zeus wallet or Bluewallet was used with the wallet connection information to LNURL-Auth login to stacker.news</p> <p>User believes their NSEC was compromised as well and has setup new Nostr account, marked old as compromised and establishing new wallets for zaps.</p> <h1 id="realizations-2">Realizations</h1> <p>Not only do Nostr keys have no key rotation, LNURL-Auth suffers from this as well. While implementation approaches can be done, we need to get more work in this area to establish common, consistent patterns for how to rotate to new keys, wallets, etc.</p> <p>In the case of a lightning wallet being compromised its quite severe as different services have no way to know the wallet is compromised as there is by design no central server to query against.</p> <hr> <h1 id="recomendations-2">Recomendations</h1> <h2 id="users-2">Users</h2> <ul> <li><p>Take extra caution when setting up wallet connect information and lightning address in your preferred clients.</p></li> <li><p>Make note of where your lightning address and wallet connection information is being used. E.g., track in a password manager.</p></li> <li><p>Be prepared to immediately take steps to update if ever compromised.</p></li> <li><p>Where possible, use a dedicated lightning wallet (without funds) for LNURL Auth logins, separate from your extensions for logging in and signing events for Nostr.</p></li> </ul> <h2 id="general-nostr-clients-2">General Nostr Clients</h2> <ul> <li><p>Where user profiles can be edited, add appropriate validation checks on the LUD06 and LUD16 fields. There are plenty of profiles with junk data that dont make sense.</p></li> <li><p>LUD06 should be deprecated, but should be a LNURL string if provided.</p></li> <li><p>LUD16 should be preferred, and only allow for values in username@domain format. Here&#39;s a sample regex:</p></li> </ul> <p><code>[a-z0-9-_]*@(([a-zA-Z]{1})|([a-zA-Z]{1}[a-zA-Z]{1})|([a-zA-Z]{1}[0-9]{1})|([0-9]{1}[a-zA-Z]{1})|([a-zA-Z0-9][a-zA-Z0-9-_]{1,61}[a-zA-Z0-9]))\.([a-zA-Z]{2,6}|[a-zA-Z0-9-]{2,30}\.[a-zA-Z]{2,3})</code></p> <h2 id="lndhub-lnbits-accounts-type-systems-2">LNDHub, LNBits, Accounts type systems</h2> <ul> <li>Add support for rotating from a compromised wallet account to a new one.</li> <li>Users and Admins should be able to mark a wallet as compromised.</li> <li>No spends should be able to performed from the account.</li> <li>Received funds should instead be diverted to replacement wallet.</li> <li>Can continue allowing LNURL-Auth to function</li> <li>Enhance API calls to ascertain if a wallet is marked as compromised</li> </ul> <h2 id="blue-wallet-zeus-any-using-lndhub-like-accounts-2">Blue Wallet, Zeus, any using LNDHub like accounts</h2> <ul> <li>Add support for any new API calls that can indicate a wallet as compromised</li> <li>Recommend separation of wallets used for receiving value vs for LNURL-Auth</li> </ul> <h2 id="alby-recommendations-2">Alby Recommendations</h2> <ul> <li><p>Where Wallet Connection warning is, make it more prominent. Use bold red colors. Inform the user that this gives full access to the wallet and is non-revocable.</p></li> <li><p>Add support for multiple wallets on an alby account. Preferably one per subaccount.</p></li> <li><p>See notes for LNDHub about handling compromised wallets.</p></li> </ul> </blockquote><br/>This is what happened. #asknostr 2023-12-03T19:45:48Z https://njump.cloud.vinney.xyz/nevent1qqsqkjtkzthj0r85qz0qh9af9lsqd2vh3v5gdaxwg8kz5rv0rny54eczyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td2ysuvlg In reply to <a href='/nevent1qqswcxcg3u3e7l2lzr8p959a87t2rylld8zftlx6jmvpdcexhuegqucxj4xj6'>nevent1q…4xj6</a><br/>_________________________<br/><br/>Yayyyyyy!!! I’m good too gooo 😆<br/>Omg, thank you #nostrplebians I love y’all 2023-12-03T17:22:12Z https://njump.cloud.vinney.xyz/nevent1qqs22d2xrt9r2v0wyqz2aguejs7lmuaau8x5g7kg7gvrupkuh6xg4zszyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td2ucrz0s Zap test 😭🥲 2023-12-03T17:17:39Z https://njump.cloud.vinney.xyz/nevent1qqszesatd6uvzz7evnvezkmpw0vrufx3wgyn58kx77cnw22hr58nq2qzyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td2hc923d In reply to <a href='/nevent1qqsfrwdf0rceymsd75eev6jsa65vjnc3sfcnfnde677p79vrhrmsp0qllkh62'>nevent1q…kh62</a><br/>_________________________<br/><br/>“Distance makes the heart grow fonder” <br/>My honest opinion is, you don’t want to be in the same city as your old dates/exs in the past. And maybe the girls might know each other. 👀 walls can talk. <br/>Try to keep an open mind about who you want to date :)<br/>#voteforjeroen 2023-12-03T17:16:29Z https://njump.cloud.vinney.xyz/nevent1qqsfms99t7hlz2fftuzzpvvlxw35lcv2vflvdmuv8ymwkeuqap8rlxqzyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td297ysyq In reply to <a href='/nevent1qqs0zlm2qqthhsdae3y85mlfgsyly5xv7lpgl68uewgq50jlk7zv0acaj0jan'>nevent1q…0jan</a><br/>_________________________<br/><br/>Work now? 2023-12-03T17:12:11Z https://njump.cloud.vinney.xyz/nevent1qqs2hjnt9spvsj9rsqp5z6hjdlm5dslgsg2kczh8r9fx3z4yqphfe5qzyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td23d7h4r In reply to <a href='/nevent1qqsxys9pyuw4l995d2fcrg4qqmjg2q4avupn4u89nmxcsyyk8uly69stuuqjt'>nevent1q…uqjt</a><br/>_________________________<br/><br/>All tru 🥲 2023-12-03T17:09:59Z https://njump.cloud.vinney.xyz/nevent1qqs0wm6yeg0m23rzp9a6um30cllp7edyyxn40cxdwhawyxfggtszneqzyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td2nrr9a4 In reply to <a href='/nevent1qqszlqjdnc3cu0km5f24tm65lat3u4rq3hd40uhv46u67ah8auzrljg3xswvg'>nevent1q…swvg</a><br/>_________________________<br/><br/>I would change the same city to “same county/state” <br/>Broaden the horizon Jeroen! 2023-12-03T17:06:37Z https://njump.cloud.vinney.xyz/nevent1qqstd6kl2uv20tf2zmfte0g257wt08z0kmmtvflwwsehwry8pn47cwszyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td2yn8jgz Am I zap-able now test…? 🥲 2023-12-03T17:05:06Z https://njump.cloud.vinney.xyz/nevent1qqswaw7yh53sxuxv4hhgmzufkn4mffrdksrgf0fs79dn0fed485060qzyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td2ztcqxf In reply to <a href='/nevent1qqs9n25ug0xf5pnl4zzppqe8vk8j2kha00ggd5lxwg45mkg8cuum2ks5k56af'>nevent1q…56af</a><br/>_________________________<br/><br/>Lol what’s the preferences 2023-12-03T17:02:42Z https://njump.cloud.vinney.xyz/nevent1qqs9kt9em459cqj4xaj7h86lc3f5uahsk5hk8tlaygcge9sdlw8rgfszyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td2z63upe In reply to <a href='/nevent1qqsxznn53al6cn20c5yhkwxaqu7z309qxcp7spz58vh9cupggmjxeasl44zs7'>nevent1q…4zs7</a><br/>_________________________<br/><br/>They not? 🥲 2023-12-03T16:54:38Z https://njump.cloud.vinney.xyz/nevent1qqsxhjmlvasax2xaff5vphddcenn7qcpfa9ctm58dazfd7q20y4vyaczyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td2u5lh2d In reply to <a href='/nevent1qqs8glwr3kzq83u3zay9yrmgwlsy7leqeanmy0m33rxffcwpstce80qgc2l90'>nevent1q…2l90</a><br/>_________________________<br/><br/>I just made a strike account 2023-12-03T16:42:48Z https://njump.cloud.vinney.xyz/nevent1qqs2c9uwvfmt4ue45460acfwzg6y2fg88wuvtykplvw2qaaarl50tnczyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td2huz5pw In reply to <a href='/nevent1qqs04lcpwevh9usjf9jdzrzml7f40xj6vzthm8fse7w2pue0t0dvyuq7ru4dz'>nevent1q…u4dz</a><br/>_________________________<br/><br/>HAHAHA, yea. It was just fun tho, I’m not trying to worry . <br/>I’ll do better . 😭 2023-12-03T16:30:27Z https://njump.cloud.vinney.xyz/nevent1qqs92wecnl6a8zs6pje79l9hhfg0afh6f8fkpatmysdf8vse734ac3gzyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td2wa527k In reply to <a href='/nevent1qqszrjpjttw50k6mg90v9dgasv46rmytueex8m8nenvtmkdsg54zwjgtn9f5j'>nevent1q…9f5j</a><br/>_________________________<br/><br/>Thanks 🙏 I luckily moved most of it before they got to everything. I’ll just cry a little, and I will be just fine. At least it wasn’t 1m sats 2023-12-03T16:25:30Z https://njump.cloud.vinney.xyz/nevent1qqsxuuve0r6wqg9a8fhkxfa63acq57mn7e6x7puq926y52gzj8nqkugzyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td2d8kyet In reply to <a href='/nevent1qqsy7aug9yc2fajkl9r59nfdytcqqadtcgrtq8g60l2ztcjd929a0gcxgps6y'>nevent1q…ps6y</a><br/>_________________________<br/><br/>You’re naturally a blonde, but now you are a brunette. <br/>#hairstylist 2023-12-03T16:23:01Z https://njump.cloud.vinney.xyz/nevent1qqszgn0yahvezpslpnxyy2647kkw4d0f0etls7hvlk0hktf30y44khszyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td2f9fla4 <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1xr8tvnnnr9aqt9vv30vj4vreeq2mk38mlwe7khvhvmzjqlcghh6sr85uum" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>TheWildHustle</span> (<span class="italic">npub1xr8…5uum</span>)</a></span> <br/>Always .<blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/note188r4aqmhl6n2tclsslx3csca7lmm5rgxdrp3l46y7vt427qcep9qwp68yt" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">note188r…68yt</a></span> </div> <img src="https://image.nostr.build/0cab574bc61bcd3858f71169da4e9d783a6daa87e15928dbb8ae959fbbda50b3.jpg"> <br/><br/>#meme #memestr #nostrmemes #memes 819,591 🤙💜 </blockquote> 2023-12-03T16:21:34Z https://njump.cloud.vinney.xyz/nevent1qqs0m2hyxqgpg0p0t6asrrclrly8k04clc45qpujks26dg09n6x7s0gzyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td2d5t0la In reply to <a href='/nevent1qqspdtgan4crpyr37wp206agj6s9mlu60ehxpvv78f5842ducn5galgdj66rg'>nevent1q…66rg</a><br/>_________________________<br/><br/>I think getAlby had me compromised 2023-12-03T16:20:45Z https://njump.cloud.vinney.xyz/nevent1qqspdtgan4crpyr37wp206agj6s9mlu60ehxpvv78f5842ducn5galgzyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td2l5ntpj In reply to <a href='/nevent1qqs0yeqfqj43qlyl4vklnxq9pyv9h83q9a74jr5dqc3uwyy2zj4qzecxdj8eg'>nevent1q…j8eg</a><br/>_________________________<br/><br/>LOLLLLL, they got into my stacker.news some how 2023-12-03T16:19:57Z https://njump.cloud.vinney.xyz/nevent1qqsx0stwd4vk8a0vnxawc64ctyyh4qydxwdhawz2qup5m6napm0gmpszyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td2wud7dn In reply to <a href='/nevent1qqsgz4wcp2zsahsvmdwpe5t6zkcry2zc5ypdk4083tfngx27ta5f5sqwwj5r0'>nevent1q…j5r0</a><br/>_________________________<br/><br/>Everyone wish it was them ; 185k sats richer. I’ll just stop zapping for the rest of 2023 2023-12-03T16:10:56Z https://njump.cloud.vinney.xyz/nevent1qqswhfurha82yly8m7e7a5x0ajsypvsku69jv9q8j6ffca9c4lz2lsqzyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td2mh46dh In reply to <a href='/nevent1qqsztqfvj3fk5wp5qtrxkze7mjzqvmsgpl62ym8afr97u908t0pvqccr4j8rk'>nevent1q…j8rk</a><br/>_________________________<br/><br/>We did, then I made a new nym and was moving sats around . I fucked up 2023-12-03T16:07:29Z https://njump.cloud.vinney.xyz/nevent1qqsfyx2x7j7xk5duw2rvcu5jms9umrcmu56gvkqlcwupy6rrdks6y9szyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td238vuqf In reply to <a href='/nevent1qqsgxm6e0j9686xaqq3mhwu7844n3kc8hk0ver7m3ch7qdcqw6nwrncq6kptg'>nevent1q…kptg</a><br/>_________________________<br/><br/>👀 I’m a retard reward gachapon machine 🫠 2023-12-03T16:04:44Z https://njump.cloud.vinney.xyz/nevent1qqszm8yzkw79uwwyy235vuune8a3zmr8xwcsz3y35tn8l2vjj5n4pjqzyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td23adxxs I was moving money, and someone took 185k sats from my wallet 😵‍💫<br/>I hope you enjoy them, I will die eventually soon and then everyone will be happy with more bitcoin. 2023-12-03T15:58:34Z https://njump.cloud.vinney.xyz/nevent1qqsvgwv8pjvsp9e8uryx35m65qz8j4s4qymg63y8yyddpzmsxyqee0qzyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td2qyjehy Hand over teh beans 🫘 <br/>#thecasine 2023-12-03T03:16:08Z https://njump.cloud.vinney.xyz/nevent1qqsq5l69dls2s2c7xem3krxv6pjfqll807dyulw8vu0gxn2kme59peszyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td2ldlc79 In reply to <a href='/nevent1qqswl88586yyyl4xdjl8tdt2lyf80zzheh3sytjuq8eywqd3l8ezq9q9un058'>nevent1q…n058</a><br/>_________________________<br/><br/>It&#39;s time to get schwifty~ 2023-12-02T10:28:01Z https://njump.cloud.vinney.xyz/nevent1qqs2c4cmcaza9p70l0rc2zlussw4graxlvrcy5z7k2l6q5m4cv87t5szyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td22298u2 Good morning freaks, <br/>I hate y’all . 2023-12-01T13:44:07Z https://njump.cloud.vinney.xyz/nevent1qqstxy7cfj89nl8hrtlxlcgrj69ywm5drd6xa3sk8tggr9sxv53cjyszyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td2cahnfe Would anyone join my nest if I even opened one again? 🥲 <br/>Just trying to get through the day till I have to go the fiat mines in like 7-8hours …<br/>I like chatty peoples :) <br/><br/>#grownostr 2023-11-30T13:25:38Z https://njump.cloud.vinney.xyz/nevent1qqsxh3uw89h8qlkr57fxtramlfj4jlxw57hlj2nhu0kpfl6ck3eyf9szyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td2jutyvg My first attempt at #glazed #donuts /uglycry. 🫠<br/>#gonutsfordonuts <img src="https://image.nostr.build/1214e2fe2a20b07264ae49aced535b0782e1043f2299b6aaaa9cbccba1dff9fb.jpg"> <img src="https://image.nostr.build/3c826bccb58f74b4b2f2fe75f736725674d41720647aaedb4c33658286e939d5.jpg"> 2023-11-29T15:01:18Z https://njump.cloud.vinney.xyz/nevent1qqspa4et77ag726na3v3yu89ty3rvu9t9vm2m9aw7e2u5ja405qrv4gzyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td29gzydq In reply to <a href='/nevent1qqsr3yd9drere4c2cx2mgrsnscv37pkxlqsuyf3xzgv9jz44wukhjjcf2qxmq'>nevent1q…qxmq</a><br/>_________________________<br/><br/>All the processed foods I can get my grubby hands on and some of Americas famous mcD nuggets and coke 2023-11-29T13:32:40Z https://njump.cloud.vinney.xyz/nevent1qqstfrjjgz8l2u23v0yjm8lfp9j3djlsxkd9weha5mu5c2mnpzelqygzyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td255h0s7 In reply to <a href='/nevent1qqstelggjkfq95lhd73k07rtrx4t299an2lctxjvmctw75u3gl0j2ech4dsq9'>nevent1q…dsq9</a><br/>_________________________<br/><br/>YESSSS!! That’s the reaction I wanted!!!! 🤩 2023-11-20T15:25:34Z https://njump.cloud.vinney.xyz/nevent1qqsqvqn3ezhkt3kckf49k9mtf7qrrz9z0ew2jtdeppsey20m6aqkhaqzyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td2cqml66 My #walls are so colorful! <br/>#wallart <img src="https://image.nostr.build/5c5732dcf497f255966f8460f77b75d9cf3cb0961f8cd0725b547cce6102c441.jpg"> <img src="https://image.nostr.build/66a2581e77c605744787e5e663df1f0fa741bdfc5db0928700e799dc379b5841.jpg"> 2023-11-20T15:16:09Z https://njump.cloud.vinney.xyz/nevent1qqspr6qjch0y88alma62rpyna27vasq8erams8zxgw8fhsyj27j6trqzyrxaznqrx6t7f2gqzlrcg532zgzhhw4fkd0klqjdf23des5eh3td2tgtd3c I have cash app stuck on my wallets , &amp; I can’t attach my other wallets… <br/>How to bypass this bug? <br/><br/>#asknostr<br/><br/><a href="https://nostrscript.suhailsaqan.com">https://nostrscript.suhailsaqan.com</a> <img src="https://image.nostr.build/63575325f6ef79081d60c51f89888c688c71437fede485d254f1e7ca113e930f.jpg"> 2023-11-15T06:21:23Z