rich1.0Geek (npub1m2…r3wgu)https://nostr.ae/npub1m2jphmdkskgnvwl5gplksl9e0zwv2sldqf9mwlpz6tyymz84g9fsqr3wgunjumphttps://nostr.aeJust opened a PR hardening how Primal's web app encrypts keys at rest which is a bit meatier than the one I submitted this morning. Previously the PIN encrypted an nsec with a single unsalted SHA-256 hash of the PIN and unauthenticated AES-CBC. The PR upgrades this to PBKDF2 (600k iterations, random salt) and AES-256-GCM, which makes brute-forcing a stored blob drastically more expensive and makes wrong PINs fail cleanly. Existing users are migrated automatically on their next unlock, so nobody has to re-enter anything. It also encrypts the NIP-46 client transport key, which was previously plaintext in localStorage, using a non-extractable WebCrypto key. https://github.com/PrimalHQ/primal-web-app/pull/211