Yes. Also, it actually is hard. You can't give your xpub to ...

Raw JSON

{
  "kind": 1,
  "id": "ea1f89bc4481d3c72a0e0ea665432a5b7fa6490c5805342cb0955211ca238dee",
  "pubkey": "0461fcbecc4c3374439932d6b8f11269ccdb7cc973ad7a50ae362db135a474dd",
  "created_at": 1779817372,
  "tags": [
    [
      "e",
      "f39dfcdee24141134a1e4cd2355fc195003eb9d88a9076385c5f6f2e6ae8a6da",
      "wss://relay.ditto.pub/",
      "root"
    ],
    [
      "e",
      "0fa2cc008afec3cacc125615f0763c477c86bb5d0b322ea79bec8df286b308b0",
      "wss://relay.ditto.pub/",
      "reply",
      "2d9873b25bf2dda6141684d44d5eb76af59f167788a58e363ab1671fefee87f2"
    ],
    [
      "p",
      "2d9873b25bf2dda6141684d44d5eb76af59f167788a58e363ab1671fefee87f2"
    ],
    [
      "p",
      "3316e3696de74d39959127b9d842df57bddc5d1c7af8a04f1bc7aed80b445088"
    ],
    [
      "client",
      "Ditto",
      "31990:781a1527055f74c1f70230f10384609b34548f8ab6a0a6caa74025827f9fdae5:ditto"
    ]
  ],
  "content": "Yes. Also, it actually is hard. You can't give your xpub to a server and then expect a regular HD wallet to be able to recover the funds because the server will create huge gaps between addresses. If you lease and expire the indexes, well then a bad actor can just hammer the server, wait for the leases to expire then track the activity anyway.",
  "sig": "984d00b817f5deebd45e1dda05fd2217298fb103cc8e8c4cd5db0db2a5433b3c63f521027b64c3f6bd2d1532b0f65c36f7442c793eb09a7c6e0be51a9006e24d"
}