mikedilger on Nostr: Ok, points taken. Right now there is a single root of trust: npub. NIP-05 is NOT a ...
Ok, points taken.
Right now there is a single root of trust: npub. NIP-05 is NOT a root of trust. It is never the case that if somebody's NIP-05 changes then clients start using the new npub transparently. It is only the case that if you didn't even know their npub you could learn it that way and then start rooting trust in the newly learned npub.
So the solution to all of our problems is for clients to manage multiple roots of trust, and transparently so for the average user.
Clients that want to do this will have to track which root of trust they use on a per-person basis:
pkarr: For you, maybe I start from pkarr, go to your domain and get your nostr information.
nip05: For Elon Musk maybe i use the nip05 at x.com... and if his npub changes I trust the nip05 more than his npub (not sure that's a great idea but whatever).
npub: For most people I know through nostr, I root the trust in their npub (and they have no way to rollover that npub because I then lose the root of trust).
ed25519: For future crypto people I root trust in their ed25519 key and maybe lookup data in Mainline DHT.
This adds immense flexibility and openness, solves key rollover, etc... but it also totally violates the "just one way to do things" and KISS principles.
Right now there is a single root of trust: npub. NIP-05 is NOT a root of trust. It is never the case that if somebody's NIP-05 changes then clients start using the new npub transparently. It is only the case that if you didn't even know their npub you could learn it that way and then start rooting trust in the newly learned npub.
So the solution to all of our problems is for clients to manage multiple roots of trust, and transparently so for the average user.
Clients that want to do this will have to track which root of trust they use on a per-person basis:
pkarr: For you, maybe I start from pkarr, go to your domain and get your nostr information.
nip05: For Elon Musk maybe i use the nip05 at x.com... and if his npub changes I trust the nip05 more than his npub (not sure that's a great idea but whatever).
npub: For most people I know through nostr, I root the trust in their npub (and they have no way to rollover that npub because I then lose the root of trust).
ed25519: For future crypto people I root trust in their ed25519 key and maybe lookup data in Mainline DHT.
This adds immense flexibility and openness, solves key rollover, etc... but it also totally violates the "just one way to do things" and KISS principles.