AKAProfiles extends NIP58 events to support adding data to badge awards. (see https://www.akaprofiles.com/docs/reference/nostr-events) To support private data, I would add "private" as an option on the "field" tag added to the Badge Definition Event. On the badge award event, for private fields, instead of returning the private value using the "data" tag, I'd return a URL/URI which can fetch the data, being agnostic in how URL authorization is performed.
I believe that any data a user isn't comfortable with being widely published should never be published to relays, unless decryption requires their own private key, as the risk of accidental disclosure due to a key comprise is too high.
akaprofiles (neilck) / AKA Profiles
npub1qq…q93ze
2024-06-27 20:39:58
in reply to nevent1q…g4m8
Author Public Key
npub1qqqqqqmh2spyzdv44j0pvy4765ygzh5ca392n452yc507c25s4hs4q93zePublished at
2024-06-27 20:39:58Event JSON
{
"id": "210c987789fe911f85a9072ad0fc6972a4eccd39d811709e10a30e19f4eae2b3",
"pubkey": "00000003775402413595ac9e1612bed508815e98ec4aa9d68a2628ff6154856f",
"created_at": 1719513598,
"kind": 1,
"tags": [
[
"p",
"460c25e682fda7832b52d1f22d3d22b3176d972f60dcdc3212ed8c92ef85065c",
"wss://vitor.nostr1.com/",
"Vitor Pamplona"
],
[
"p",
"06b7819d7f1c7f5472118266ed7bca8785dceae09e36ea3a4af665c6d1d8327c",
"wss://relay.damus.io/",
"Tim Bouma"
],
[
"e",
"e431ba2bd27e1f68104f3ab93649a18901559039a3dce3d9da782478a945978c",
"wss://vitor.nostr1.com/",
"root"
],
[
"e",
"10880435780da73aba537f3b35884db49dd4e83113fc10582e67f2c00fbec7e3",
"",
"mention"
],
[
"e",
"bd78408616e9a39c7d8cbee54df89e8281498da0e8e5d39d909fb4720c7d3b23",
"wss://vitor.nostr1.com/",
"reply",
"460c25e682fda7832b52d1f22d3d22b3176d972f60dcdc3212ed8c92ef85065c"
]
],
"content": "AKAProfiles extends NIP58 events to support adding data to badge awards. (see https://www.akaprofiles.com/docs/reference/nostr-events) To support private data, I would add \"private\" as an option on the \"field\" tag added to the Badge Definition Event. On the badge award event, for private fields, instead of returning the private value using the \"data\" tag, I'd return a URL/URI which can fetch the data, being agnostic in how URL authorization is performed.\n\nI believe that any data a user isn't comfortable with being widely published should never be published to relays, unless decryption requires their own private key, as the risk of accidental disclosure due to a key comprise is too high.",
"sig": "154d34f1ff63fe062e12fae8bdd5cefc5696bb6930122a4e92ad7d3634ca230ed1979934acddb5acd3c1181fcd87ac8ae4b325cd68d48ee5391464f350bdc6ff"
}