nielliesmons on Nostr: So if my chat app is a signer, what's so dangerous about interacting with an ...

So if my chat app is a signer, what's so dangerous about interacting with an HTML-based widget inside my app?
Especially if that widget is Nostr-comms-only (no legacy API's etc...)

The alternative is that users are directed out of my app to a handler that is likely web-based anyway (with a way larger attack surface) and for which the first thing they'll need is...

A signer 🤦‍♂️