Local bunker ignores temporary secret

[alopatindev]

I tried

nak bunker --sec ncryptsec... relay.damus.io nos.lol relay.nsecbunker.com

and noticed that logging in multiple (wnj) clients using the same bunker URI works, which is not expected.

But it turns out it's even worse: modifying the secret and then passing the URI to client also works.

[fiatjaf]

I think I get it. Did you also try to sign an event? The code currently allows anyone to call getPublicKey() because that information is already public anyway, but it shouldn't allow anyone to sign an event under your name.

[alopatindev]

but it shouldn't allow anyone to sign an event under your name

Oh, this seems to be correct: I can't sign event if used the same bunker URI twice or URI with wrong password. Pretty non-intuitive from end-user perspective though (successful login but not signing).

[fiatjaf]

I agree, we should deny getPublicKey() too.