Aspie96 on Nostr: > Security, not so much, lol. Nostr is pretty secure in a way that traditional social ...

> Security, not so much, lol.

Nostr is pretty secure in a way that traditional social media aren't.
When you fetch a tweet from Twitter, or a post from Facebook, you are *trusting* that neither Elon nor Zuck have compromised the content of the message.
They *probably* wouldn't do it, but from a technical prospective they absolutely could.
If you fetch a post on Nostr, you know it actually has been published by someone who knows the private key of that public key. This is cryptographically proven and there is nothing relays can do to modify the content of messages.

> If I understand correctly, anyone can log in as anyone else with their pubkey, but it’s read only.

Not really.
Nostr has no concept of "logging in". It's a protocol and authentication is only mentioned in some optional and marginal features.
Clients, such as noStrudel, but also others, may (and typically do) implement a "log in" function.

You cannot log in with someone's public key, in a meaningful sense. What you can do is fetch events by public key. This isn't a security bug, this is exactly the expected behavior, by design.
Clients may call this "log in", but it's not really something only the actual owner of the key is supposed to be doing. Fetching events is something you are supposed to be able to do, be it trough a client, trough a command line or by manually using the protocol.

> Allowing people you have blocked to continue following you or allowing anyone to stalk your account using your pubkey, is creepy AF and should also be addressed.

It is not assessed on traditional social media (users can just create another account) and it cannot be addressed on Nostr.
Nostr clients aren't meant to limit what users do in any way whatsoever. That's because any user can make their own client. You *never* trust other's clients to behave in a certain way. You control your own client and others control theirs.
Events on Nostr, of all kinds, are public. Anyone can fetch them from relays.

Blocking people on social media is not a form of IT security and the illusion that it can be is, if anything, a mild security threat.
Nostr has no concept of "blocking".
It does have mutes, but this only means you choose to not see messages published by a certain user. You can also choose to not see messages published in 2023, messages that contain the word "word" or messages that are above a certain length.

The protocol specifies none of this, it's just something at the client level, not really part of Nostr itself. And, as I said, you control what your client does.