This is a serious privacy concern and my opinion is that nobody should use the new ...

2025-10-16 19:28:49 GMT

This is a serious privacy concern and my opinion is that nobody should use the new WoS Spark wallet without being fully aware of the risks. ⚠

I crash-tested this myself, comparing a Breez_tech (npub1jug…fc28) SDK Spark wallet with Wallet of Satoshi (npub1hcw…h9rq) and here’s what I found. 🪖💥

The first screenshot is an invoice from Breez, the second is from WoS. You can clearly see that the Spark address is only exposed in one of these. 👇

quoting
nevent1q…ff8m
🔬 Spark Lightning Address Doxxer: a simple tool to decode Spark addresses from any Lightning address or invoice.

https://reneaaron.github.io/spark-lnaddress-doxxer/

Does somebody understand why WoS addresses seem to encode the spark pubkey as a routehint, but other providers such as blitz wallet do not?

h/t benthecarman (nprofile…p6uv)

Author Public Key

npub1aeh2zw4elewy5682lxc6xnlqzjnxksq303gwu2npfaxd49vmde6qcq4nwx

Seen on

wss://nostr.mom wss://nos.lol wss://offchain.pub wss://nostr.land wss://eden.nostr.land wss://nostrelites.org wss://nostr-01.yakihonne.com wss://relay.mostr.pub

Show more details

Published at

2025-10-16 19:28:49 GMT

Kind type

1 Short Text Note

Event JSON

{ "id": "b0a2e157e5ffceae8e65e886e174b06b657893dccb1742aac79b6e148d332f51", "pubkey": "ee6ea13ab9fe5c4a68eaf9b1a34fe014a66b40117c50ee2a614f4cda959b6e74", "created_at": 1760642929, "kind": 1, "tags": [ [ "imeta", "url https://i.nostr.build/FJnDxgAjNsfzhdWb.png", "ox 11e0095baafe1a13dccd9af4df65cb826f9e75e554514c0d578f19953c8cff94", "x 490f939294b3ef993ae03c600ea5a0c188c9034e66d6ec4afd11cebbc96ce0fc", "m image/png", "dim 1454x818", "bh LRRfh3t6xu%M.8WBWBof~qfPRjof", "blurhash LRRfh3t6xu%M.8WBWBof~qfPRjof", "thumb https://i.nostr.build/thumb/FJnDxgAjNsfzhdWb.png" ], [ "imeta", "url https://i.nostr.build/vDowAwldJAoZ8oT7.png", "ox f6b3bfe3aa7863cfde6acbd78c0bf9b712ad4aba4347793522ffc4842b473be5", "x 1269fb5f1e9e1720bc4588682cc8c25fd7075d24953e950d17b67c737cef0682", "m image/png", "dim 1454x818", "bh LQRMh^ofxu-;^,ayaxof~qaxM{of", "blurhash LQRMh^ofxu-;^,ayaxof~qaxM{of", "thumb https://i.nostr.build/thumb/vDowAwldJAoZ8oT7.png" ], [ "q", "1e35c2c3868f0717009a853a97d2213d89b89d56097fab884f055d905481ead7", "wss://relay.damus.io/" ], [ "p", "9711d1aba806a3a285ff3e87d175902c2f250741860d9c65903c8b5e863ebd81" ], [ "p", "be1d89794bf92de5dd64c1e60f6a2c70c140abac9932418fee30c5c637fe9479" ], [ "p", "cd169bd8fbd5179e2a8d498ffc31d3ae0e40825ff2b8a85ea359c4455a107ca8" ] ], "content": "This is a serious privacy concern and my opinion is that nobody should use the new WoS Spark wallet without being fully aware of the risks. ⚠\n\nI crash-tested this myself, comparing a nostr:npub1jugar2agq6369p0l86razavs9shj2p6pscxecevs8j94ap37hkqsjlfc28 SDK Spark wallet with nostr:npub1hcwcj72tlyk7thtyc8nq763vwrq5p2avnyeyrrlwxrzuvdl7j3usj4h9rq and here’s what I found. 🪖💥\n\nThe first screenshot is an invoice from Breez, the second is from WoS. You can clearly see that the Spark address is only exposed in one of these. 👇\nhttps://i.nostr.build/FJnDxgAjNsfzhdWb.png\nhttps://i.nostr.build/vDowAwldJAoZ8oT7.png\nnostr:nevent1qvzqqqqqqypzpngkn0v0h4ghnc4g6jv0lsca8tswgzp9lu4c4p02xkwyg4dpql9gqy2hwumn8ghj7un9d3shjtnyv9kh2uewd9hj7qgwwaehxw309ahx7uewd3hkctcqyq0rtskrs68sw9cqn2zn497jyy7cnwya2cyhl2ugfuz4myz5s84dwzvff8m", "sig": "1ede1014246a00262ffd8bda4440dc771aaf6de418c71f10a94d4ed93b6df87c3bdf05c38630cdca6c0898579a7e39714900e195dd9128d6a559740ebf583309" }

daniel on Nostr: This is a serious privacy concern and my opinion is that nobody should use the new ...