Every REQ id NDK generates is built as "$name-${Helpers.getRandomString(10)}", on both paths:
Relays receive ids like load-metadatas-aB3xK9pQrS, user-relay-lists-..., dm-relays-..., nwc-sub-notifs-only-..., feed-page-initial-aB3xK.
Three signals given away for free, on the very first REQ:
name is an internal debug label. It tells the operator which usecase issued the request when the filter alone would not, and the vocabulary is NDK specific, so it fingerprints the client.- The
-page-initial- / -page- markers announce that the client is paginating and which phase it is in.
- The suffix comes from
getRandomString, a mixed-case base62 alphabet. Most clients send hex ids because they derive them from random bytes, so base62 stands out.
Fix: Helpers.getSecureRandomHex(16) for 32 hex chars on all four call sites, keep name client side for logging only. Worth adding the id override to query() for parity with subscription().
relay_sets_engine.dart:302 also uses getRandomString(10) on its own, without a name prefix. Same alphabet question, no name leak.
32 hex chars is safe everywhere.
Every REQ id NDK generates is built as
"$name-${Helpers.getRandomString(10)}", on both paths:Relays receive ids like
load-metadatas-aB3xK9pQrS,user-relay-lists-...,dm-relays-...,nwc-sub-notifs-only-...,feed-page-initial-aB3xK.Three signals given away for free, on the very first REQ:
nameis an internal debug label. It tells the operator which usecase issued the request when the filter alone would not, and the vocabulary is NDK specific, so it fingerprints the client.-page-initial-/-page-markers announce that the client is paginating and which phase it is in.getRandomString, a mixed-case base62 alphabet. Most clients send hex ids because they derive them from random bytes, so base62 stands out.Fix:
Helpers.getSecureRandomHex(16)for 32 hex chars on all four call sites, keepnameclient side for logging only. Worth adding theidoverride toquery()for parity withsubscription().relay_sets_engine.dart:302also usesgetRandomString(10)on its own, without a name prefix. Same alphabet question, no name leak.32 hex chars is safe everywhere.