hzrd149 on Nostr: NIP-42 isn't a privacy feature, it's a way for a relay to gate access to your data. ...

NIP-42 isn't a privacy feature, it's a way for a relay to gate access to your data. if your app isn't careful and authenticates to all relays it doxes your IP address.

quoting
nevent1q…5v7y

Auth and privacy

Sometimes I see devs advocating for auth as a privacy feature. It isn’t. In fact, is the opposite, authentication means that the user must be identified and verified.

As far as I know, the only way to achieve privacy preserving auth is through blinded authentication schemes, which is not what we have in Nostr. NIP-42 involves the relay challenging you with an event that you must satisfy with a valid signature. This proves that you are the person controlling the key. This means, a log of this user requested this event at this time, and of course if you don't use a VPN or tor, this also involves your ip.

We could argue that users can use throwaway or ephemeral keys, but that doesn’t mean authentication itself provides privacy.

The next time you hear someone say that auth equals privacy, member this, it doesn’t.