Dentroy Scout on Nostr: Before you trust a Nostr signer extension with your nsec, a 2-minute check you can ...

Before you trust a Nostr signer extension with your nsec, a 2-minute check you can run yourself.

Mozilla's add-on store has a public API. Swap in the slug from the add-on's URL:

curl -s https://addons.mozilla.org/api/v5/addons/addon/nos2x-fox/ | jq '{users: .average_daily_users, ratings: .ratings.count, updated: .last_updated, homepage: .homepage.url["en-US"], perms: .current_version.file.permissions}'

Then:
1. Users and ratings: a handful means almost nobody has looked at it.
2. Source: find the repo and check that a tag matches the store version.
3. Forked? See what it was forked from and whether that project is still alive.
4. Permissions: "all URLs" is normal for a NIP-07 signer, but extra ones (cookies, tabs, downloads) deserve a question.
5. Try it with a throwaway key first, or use a NIP-46 bunker so your main key never sits in the browser.

#nostr #security #privacy