Building Universal Permission-Based Messaging in Web3 | Naomi Plasterer - XMTP

[Music] hey everyone um welcome to building Universal permission based messaging in web 3 um I'm Naomi hi I'm an engineer here at xtp um I've been there for a little bit over a year I wrote Our cotlin sdks or react native SDK and I maintain all of our mobile sdks uh which includes flutter and Swift um I worked at a couple of startups get of being my most notable I was there for six years um aside from that I have a bachelor's of Science in um Computer Science and Mathematics from Colorado School of Minds right here in Colorado so uh it feels good to be back my first job was actually at a company called SP media here in downtown Denver where I was writing PHP um I also have a master's degree in animation so if you're into art also into art so why is universal allow and block preferences important well have you ever had that one person who just won't leave you alone they Hound you with DMS on Instagram they send you messages on iMessage they somehow get your email your phone number and you have to individually go and block them from every single account that you have well I'm here to tell you about how we're solving this in web 3 so what is xtp I'm just going to Breeze through this in case you're familiar but xmt is an extensible messaging transport protocol it's an open source protocol Network and standard for secure private web3 messaging the way I like to explain it is think of if you could send messages from signal to your friends on WhatsApp without having to download the same app to communicate and by pres preserving your own privacy from the big centralized companies that run those apps you own your messaging and you get to choose which app you want to use XMP is a protocol not another messaging app with web 2 messaging is siloed inside each app I can't send a WhatsApp message inside a Snapchat or a Twitter message inside of Facebook you don't own your messaging the apps do we currently have six sdks allowing you to add private messaging into almost any app that you could imagine and a rust backend that runs the C the cryptography to help keep things performant so let's get into the details of an all of allow and block preference based messaging so the idea behind this is if you block someone in one place they are blocked everywhere on the network so that means if you don't want them messaging you in one app they can't reach you on a different app we've done this with two levels of security and privacy we use hkdf to derive a deterministic topic secret from a user's existing identity key the public topic includes the Sha 256 of the derived key so users are only able to identify their own topics then to encrypt the block data we first generate a new key via hkdf from the user's identity key and then encrypt the message via a a es GCM using the derived encryption key and the user's public key as Associated data we do all of this to protect you and who you are blocking so how does it work the protocol is set up in a way to allow the storing of any type of identifier currently it supports addresses and group IDs so you can allow or block an individual or an entire group so the flow would go like this a user gets a message from an unknown address the user can see the messages spam so they block the address the app then makes a call to our Network to let the network know that this address has been blocked the network encrypts that data and publishes it the user then logs into a different app and this app now fetches the consent records from the network they can see that this address has been blocked so they update the UI accordingly and the user does not see any more messages from this address anywhere so it would be essentially like if you blocked someone on YouTube and now they also are blocked on Instagram so what about group chats it turns out that the messaging industry as a whole hasn't really landed on a standard on how to handle this at all some apps just hide the users's messages entirely others show a dialogue saying the message is hidden some don't do anything at all seems like you kind of get a mixed bag of what's going to happen depending on which app you're using there is a solution that we've landed on um that has a lot of security guarantees it's called open MLS uh open it's an open source implementation of the messaging layer security protocol it's the most secure you can get with messaging and most of the big messaging apps today don't use it so XMP recently released an alpha version of group chat messaging using open MLS for the most secure level of messaging this means we provide forward secrecy which prevents messages sent today from leaking even if a future compromise happens post compromise security which prevents messages in the future from leaking even if a compromise happens today uh key revocation which allows users to disable keys if they ever become compromised or are no longer needed anomy of the social graph this prevents the network from determining which users are communicating with each other anomy of the sender prevents the network from determining who each message originates from message authentication which prevent attackers from masquerading as a conversation participant message confidentiality which prevents attack from reading the contents of each message and message Integrity which prevents attackers from tampering with the contents of each message but our group chat security goes beyond just MLS we also have allow and block preferences so the network allows blocking an entire group or just blocking an individual but it's up to the app to decide how to display that this means apps can handle this in whatever way they think is best but we do have a standard that the protocol will recommend currently that is hiding the blocked users messages in the group view but an xip will be open for comment by the community so we can land on a standard together the protocol also has ad admin permissions on groups which allows some control around who can add or remove people from a group chat you own your messaging and you own who can reach you where this is something that simply cannot be done in a centralized world even Beyond messaging controlling who you can reach you or see you in a universal way is powerful so in conclusion Universal allow and block preferences offers a powerful solution for protecting privacy but allowing interoperability between applications I'm really excited to see what imaginative ways Universal block and allow preferences are used in a decentralized world protecting people on all new levels and you can find us at Booth 517 in privacy bille um and I know you probably can't ask questions in this room so I uh I do have some frequently asked questions that people sometimes ask me that I I can um I can go through here so one question I get a lot is uh how many people are allowed in a group chat that we have uh currently we're capping at 250 people but it's not for technical reasons this could increase in the future um another question I get a lot is what does alpha mean for group chat and when will it be ready for production uh so we're currently in active development on group chat which means some things may break because of that we don't have the ability to use groups and production yet but are working as fast as we can to get to a stable version uh we're really looking for a lot of feedback here so we can get to that stable version faster um another question is when will you be fully decentralized uh we have a road map online but our hoping for Springtime for our first level of decentralization so that's happening quickly so yeah if you want to engage or learn more about building with XMP here are some of the channels you can find uh The Wider community on and also look for us um tomorrow we'll be around the hackathon and also in privacy Ville thank you really f