Egge on Nostr: One of my primary goals for the next iteration of npub.cash is to make authorization ...
One of my primary goals for the next iteration of npub.cash is to make authorization simpler, while keeping a high level of security.
The new version no longer relies on NIP-98 alone but on a mix of NIP-98 and JWTs. Most of the protected endpoints can be accessed by providing a valid auth token. This token can be obtained by providing a valid NIP-98 event ONCE. At the same time, all endpoints still accept valid NIP-98 headers instead of the JWT (this is great for apps that have full access to nsecs).
By default withdrawing is not possible using a JWT. However, users can opt-in to withdrawals using JWTs by signaling this when acquiring their auth token using NIP-98.
This keeps things secure, while at the same time reducing NIP-07 friction a lot. Reduced NIP-07 friction equals higher security as it makes sure users are not bullied into insecure default settings for their signers.
Finally, this opens up the possibility of OTP logins via nostr DMs. Instead of obtaining a JWT using NIP-98, users can get one by providing an OTP that the service sends via a secure nostr DM. I am still figuring out the best defaults for this, but I think the best way would be to require a second OTP on withdrawals.
The new version no longer relies on NIP-98 alone but on a mix of NIP-98 and JWTs. Most of the protected endpoints can be accessed by providing a valid auth token. This token can be obtained by providing a valid NIP-98 event ONCE. At the same time, all endpoints still accept valid NIP-98 headers instead of the JWT (this is great for apps that have full access to nsecs).
By default withdrawing is not possible using a JWT. However, users can opt-in to withdrawals using JWTs by signaling this when acquiring their auth token using NIP-98.
This keeps things secure, while at the same time reducing NIP-07 friction a lot. Reduced NIP-07 friction equals higher security as it makes sure users are not bullied into insecure default settings for their signers.
Finally, this opens up the possibility of OTP logins via nostr DMs. Instead of obtaining a JWT using NIP-98, users can get one by providing an OTP that the service sends via a secure nostr DM. I am still figuring out the best defaults for this, but I think the best way would be to require a second OTP on withdrawals.