YeOldeHodler [OLD ACCOUNT SEE PROFILE FOR NEW NPUB] on Nostr: In light of recent events with web clients some of y'all have expressed concerns ...
In light of recent events with web clients some of y'all have expressed concerns about using Bija (npub19pl…y5l0) because it's UI runs in a browser, so I'm making a few changes.
I will be looking at integrating alby but that will likely not be until January sometime. What I am doing for now is set it up so that you don't ever need to expose your private key in the browser, you can do your account setup at the command line.
One thing I want to clarify is that although Bija's UI runs in a browser it is never directly exposed to data received from relays, everything is sanitised on the back end before being sent to the UI. The only external sources loaded in the browser are images and other media linked in posts. I wouldn't be so bold as to claim there's no vulnerabilities, that remains to be seen, but there's certainly none I'm aware of and sanitising data before it's received by the browser definitely mitigates a lot of risk.
In the current release private keys are exposed to the UI in 2 ways (which will change asap)
1) When you first create or add your keys.
2) Within the settings page there's an option to view your keys.
Again, with the upcoming changes you will be able to create/add keys at the command line so you'll never need to do the former. WRT to the latter, if you add a login password (you'll also be able to do this at the command line) the only way to view keys in the browser would be to enter your password.
* Having a login password also means that your private key is stored encrypted.
I hope this resolves some of your concerns. Without reviewing the code yourself you obviously still need to trust Bija, but again, I will look in to Alby integration so that then at least you have the choice between either trusting alby or trusting bija with the keys.
Peace 🙏
I will be looking at integrating alby but that will likely not be until January sometime. What I am doing for now is set it up so that you don't ever need to expose your private key in the browser, you can do your account setup at the command line.
One thing I want to clarify is that although Bija's UI runs in a browser it is never directly exposed to data received from relays, everything is sanitised on the back end before being sent to the UI. The only external sources loaded in the browser are images and other media linked in posts. I wouldn't be so bold as to claim there's no vulnerabilities, that remains to be seen, but there's certainly none I'm aware of and sanitising data before it's received by the browser definitely mitigates a lot of risk.
In the current release private keys are exposed to the UI in 2 ways (which will change asap)
1) When you first create or add your keys.
2) Within the settings page there's an option to view your keys.
Again, with the upcoming changes you will be able to create/add keys at the command line so you'll never need to do the former. WRT to the latter, if you add a login password (you'll also be able to do this at the command line) the only way to view keys in the browser would be to enter your password.
* Having a login password also means that your private key is stored encrypted.
I hope this resolves some of your concerns. Without reviewing the code yourself you obviously still need to trust Bija, but again, I will look in to Alby integration so that then at least you have the choice between either trusting alby or trusting bija with the keys.
Peace 🙏