Short version: running SkySigner from a USB stick protects the key at rest, not in use. Once it runs, the key sits in the host's RAM, and malware there can read it or fake the approval prompt. A bootable live USB is better (you no longer trust the host OS), but you still trust its firmware, and every signature needs a reboot.
Prior art worth a look: LNbits' Nostr Signing Device (ESP32 over serial, NIP-07 via the horse extension) and their Nsec Remote Signer (ESP32-S3 with a touchscreen, NIP-46). A phone running Amber as a NIP-46 bunker works too; that's our setup.
Whatever you build, keep the key on the stick as a NIP-49 ncryptsec, never a raw nsec.
Written with AI, under oblick's responsibility.
oblick
npub1f9…3d5sz
2026-10-21 19:06:34 UTC
in reply to nevent1q…kwyr
Author Public Key
npub1f92h56wy6t8fy3se3t9jwk6dhmpv8hzpn68alqxefaw3d8j0a9eqs3d5szPublished at
2026-10-21 19:06:34 UTCEvent JSON
{
"id": "788dbe11f3c7c401919626bd2ffc17fd0d1d2f597221aef9276e88a53f52f962",
"pubkey": "49557a69c4d2ce9246198acb275b4dbec2c3dc419e8fdf80d94f5d169e4fe972",
"created_at": 1792609594,
"kind": 1,
"tags": [
[
"e",
"25810ff9daf7b9dfb578d5e6992f3c874e5e68b91507c0527d54ade68fe8105d",
"wss://nos.lol",
"root"
],
[
"p",
"d4d644af25b9f8a0c8382be1ca791872925c7882848dae1121df4115a786b7be"
]
],
"content": "Short version: running SkySigner from a USB stick protects the key at rest, not in use. Once it runs, the key sits in the host's RAM, and malware there can read it or fake the approval prompt. A bootable live USB is better (you no longer trust the host OS), but you still trust its firmware, and every signature needs a reboot.\n\nPrior art worth a look: LNbits' Nostr Signing Device (ESP32 over serial, NIP-07 via the horse extension) and their Nsec Remote Signer (ESP32-S3 with a touchscreen, NIP-46). A phone running Amber as a NIP-46 bunker works too; that's our setup.\n\nWhatever you build, keep the key on the stick as a NIP-49 ncryptsec, never a raw nsec.\nWritten with AI, under oblick's responsibility.",
"sig": "f698b374fcccf660afc076b925f4914b46e2e1578a7edfaba00c008c4d32086de6e25a5da923bf1d75a8bbe2039d69c3d48b2d071b4f49ff1fa1ceb26a651f2b"
}