TLSNotary - Cafe Hour

Transcript

just that you know so uh welcome to uh Cafe hour uh Cafe hour is actually on a temporary break while the communications team is Reinventing it but we have some uh a lot of TS notary updates so we organized this extra Edition so welcome everybody uh feel free to ask questions or if you have feedback on uh what we're discuss discussing and like I mentioned this uh session is recorded So what do we have on the agenda today um lots of chatting updates from the TS notary team so what we have been working on and uh what we will be

working on next and then uh tokino will also give a demo on all the progress we made uh at the for the browser extension so maybe a special shout out to the TS notary team so we have have Dan um I see senu I see trauma tukino Thomas Tyler I hope I didn't skip anybody so uh welcome everybody so do we have questions before we kick off no okay then uh senu I invite you for update on release

yeah I'm there's no when off decode questions yeah I'll just uh I'll pull up just our release notes from the Alpha 6 that we just put out this week um is my screen showing up yes cool yeah I'll just briefly walk through it and maybe add a little bit extra detail to a couple of different things yeah so we just put out Alpha 6 it is um setting the groundwork for future upgrades a lot of it is kind of like internal refactoring um behind the public API we had a lot of changes going into mpz which is the NPC library that uh we use to build heal this

notary so a lot of it is going into uh just setting up the capability to pre-process more and more stuff ahead of um the actual like proving process where you're connecting to the server um so yeah uh we got a bunch of work merged into mpz and we we just got that integrated into TLS notary in this release uh you should see some improvements in like the online time so um the approver and the verifier they'll connect and they'll do a bunch of pre-processing and then they'll connect to the application server um so like this doesn't really affect like the total proving time but it'll make sure that um well we should see less like

timeouts with the application server during during like the TLs handshake and so on and so forth so the gist of it is is that uh like the online time the actual time that you're connected to the server should be reduced around like 30% on like higher latency connections between the prover and the verifier we we do know that we were that um some of our users were running into this and this is a high priority for us right now because timeouts are uh totally show stopping if you're timing out it just doesn't work so we're working on fixing this um but yeah we're not done uh there's still more changes we're going to make to mpz to make this better and uh in a future U tless notary release um

yeah we'll get even more stuff kind of pre-processed there and and time mode should just become a thing of the past um and yeah on top of these npz changes as well as um uh yeah on top of the npz changes we rid the way that we do uh gash in TLS notary so um I'm not sure if any of you are familiar there's another similar work out there uh from C Labs um lightweight authentication of web data via gooll impr proof it's very similar to TLS notary uh and in their paper they showed that um a certain consistency check that we're doing in our protocol

isn't actually necessary um so we were able to um to uh to borrow this optimization from them and it prevents well it it stops the need from the approver revealing the Mac keys to the verifier after the TLs connection is closed and uh yeah this just provides a little bit better uh security uh guarantees for the prover and it also again it reduces um like total protocol time and is generally a lot cleaner so yeah huge shout out to pad abs for talking with us on this and uh yeah we we uh we're happy that uh this rough Edge is kind of worked out of the protocol next up is uh notary client so

Chris on our team um uh put together a uh client implementation for our reference notary server not everyone is using the notary server necessarily uh but we do have one there it's just kind of like a simple umum server that just hosts a notary out of station service but we never had like a a client for actually interacting with it that was always pretty manual and fairly uous um but yeah if you go to our examples now I'm just looking at like our simple like Discord example you can see the client in action uh just setting up like the notorized some config and you you call

go and uh it'll pass you back the the connection to the notary and kind of handle that all for you so um yeah it's a lot lot nicer experience and yeah that's most of what was put into this release there's a couple other like odds and ends um just like refreshing some fixtures that we had that were causing um people issues with like running tests and so forth um yeah so relatively small release all things set at the end of the day but um we're we're definitely looking to start um releasing at a higher frequency and uh yeah so as far as next priorities

go um we know that a lot of people are still waiting for atic code we have actually done a lot of the work that is needed to prep the the release of atic code uh but our attention got kind of shifted towards this timeout issue that that that we tackled in this release uh but yeah next couple of releases we're going to be uh releasing Chang is to um essentially like the adastation uh stuff from from the notary side um a lot of the data structures that we have there aren't necessarily that well thought out so we're going to have a fairly large refactoring to um the uh the data structures and API for working with Adda stations and this

is different than the like direct Pro verifier like interactive proving flow that we have this is specifically where prover connects to a notary the notary doesn't see like the server Identity or any of the data but he he signs a add a station to a commitment and uh yeah a lot of that API is going to be reworked and that's going to pave the way for a new commitment type uh which is a decode so we'll finally have a um a uh arithmetic half hash function uh commitment to the plain text available uh so yeah keep an eye out um that's our coming up next on our Focus here over the summer and of course um some people are aware that we're also trying to get

quicksilver integrated as well um and yeah that's still at top of the priority list but we're we're trying to deliver some of these these earlier promises right now uh specifically optic kod so it's going to be a uh eventful summer yeah I think that's all I had for uh core protocol updates maybe we can pause there anyone has any questions Perfect all right I'll kick this over to sakino and he has some things to say about the

extension also feel free to ask questions in the chat hello everyone my name is suino share my screen um we did quite a bit of update um on the extensions uh let's see the first thing I want to show is the plug-in system that we've implemented for the extension so um we have found out that a lot of teams are building on the extension um one of the team um has to F the

extension because they have to add some custom use case um based on the rate that they they want the application to interact with the extension so to kind of help um application developer in know ecosystem better um we added the way to implement a plugin um that you can install on the extension so a plugin is basically a bom file um and I'll will show what that looks like in just a second but now let me kind of demo the functionality here um here if I want to install a plugin uh all I have to do is

to um select the wome file um it will um it will specify from a configurations um what type of permission it will require from the extension so in this case this Twitter profile plugin that will off um that will create a proof of your Twitter profile name um we request the following um permissions so if I allowed it it will install the plugin um which I already have pre-installed before the workshops um and then you can simply interact with it now so I'm going to open a new tab

and select this it uses the side Pano API in the extension um so that users can kind of go along with the pro um the progress of the um moving flow while they are on the page that they want to notorized um I'm on x.com trying to notorized here um it checked that step one is already done which is to visit to the website now I have to make sure I have the cook um and once it does it will then autom kick into notor I on the right hand side here I'm running a local

notary server um and you can kind of see the progress here now it's done and it created this proof that you can view download and share can you zoom in a bit um which part uh the text is a bit small but we we grasp the ID I don't know if zooming works here how about this yeah better thanks okay no problem yep so yeah I created proof that you can view download share to people and they will be able to verify your comp username basically um other than

this plugin Hendrick and tenner also have created cre a few more um that I'm not going to show here um but what I will show is an example of what a plug-in looks like so here a plugin is pretty straightforward it's built using this project called exm um which allow you to compile any language to a ROM plugin that you can execute on um any environment that can execute wasm um I chose to use JavaScript because that's the language I'm

Bing um and the key part of the plugin is this configuration files um so in the configuration files it specify some metad data such as title description and icon of the plugin for presentations and then for the logic of the um plugin uh the developer have to specify steps so this is a steps API that um correspond to what is presented here as well as the action that it takes on each steps so for example step one we'll call this function called start

and in start you can kind of see that what it's doing is to check to make sure we on the correct host if not go to Twitter and on here step two is to grab cookies um and the way that it grab cies is by specifying the Kies that it will be injected to the plugin so as part of the configuration Json you can specify which um which cookie from which website um well the cookies that you want to access from a specific website um so in this case I'm specifying api. x.com and I want both cookies and headers to be

accessible by this plugin um and then on this function step two um I am basically um grabbing the cookies and headers from api. x.com that is stored by the extensions doing some manipulation to grab the data that I want and then construct a re request object um that that I will later use to um send a request to the notary and finally um I'm calling notorized to submit a notarization request to the notary um it goes by a waterf flow logic so whatever you return from step one

will be passed into step two as a input and whatever is returned from step two we'll be passing to step three as an input um with this kind of simple API um it should satisfy um at least the use case that we have seen so far um that is being built by other teams um and if you're building a Plugin or if you're application developer that has other ideas that um that you wish to see from these plugin um SDK please reach out to me or anyone that's team and I will try to Incorporated in future updates

um cool so other than that um we also have added a Content script that is injected by a by the extension um so it's kind of similar to metam mass where you are able to interact with the extension via a client that is inject injected by the um extensions we have this injected client called TSN um and if I call tn. connect actually let me do it on a website that I have never connected before um yep if I do

it on here on a website that I never connected before um a popup will open and request access for me to connect to this website it will tell the users the type of things that um the website can do if um a connection is granted so I'm going to Grant it and then with this client object I can basically request different things from the extensions um for example here I can request to see all history that has been notorized well all notarization history done by the extensions um it will ask the users if they want to share it and if they do

this will be returned back to their applications and they will be able to see it I can also use it to submit a notarization request um in this case I'm trying to um well google.com is trying to request a not ration to be done um through this request URL well I can manipulate it just like how um I normally do with the extensions I can highlight to do some reductions and then click on notarize and then after notarization is done the proof will be returned back to the um console and there you go the

notification is done and the proof is returned back to the client so with this inject the client um the goal is for um application developer um to be able to interact with the extensions similar to how one would integrate with uh metas and then they can use it to like create netization grab history or you know if you have ideas that um you think the extension should support again reach out to us and that's kind of it yeah maybe it's worth uh reiterating that so that's why the configuration is

important is to protect the uh the end user so that not uh malicious uh apps start doing uh random notorized [Music] [Music] Prost so there the the plugin info uh yeah so the plugin source code so there we made a new repository where you can get a boilerplate template to start a new plugin and uh everything TLS not 3 develops is open source so the extension

is also open source in the tlsn extension Repository um yeah okay are there more questions okay then um we have some other uh random updates maybe so um we went to uh EDM in April and then we had our first hacker house um near Amsterdam which was a a

very nice Gathering of the team and 10 early adopters where we had plenty of uh engaging discussions about the protocol um it was a good thing that it was rainy weather because we uh got a lot of work done so exciting times um um uh upcoming events so uh the one more week on I think July 11th on Thursday uh we have a talk about THS NY at etcc uh you can find us around noon at hanar stage uh then after etcc in the weekend there's eat Global Brussels so uh the

hecaton where we invite you to build on top of DS notary or to write uh extra plugins we even have bounties for that so if that's uh you're planning to do that also feel free to reach out early uh on our Discord that we can uh discuss the your IDs then a bit further um some of us will be at uh atcon in Japan uh the end of [Music] July then some of us will be at dweb Camp that's early August and then the end of August uh Chris uh will also be at e Toyo uh Japan again and then of

course the uh most of us will also be in uh southeast Asia Bangkok for Defcon in November um so Dan asks is there any plan for a next Hacker House uh nothing concrete but it was such a success that we definitely want to repeat it uh but that will be somewhere next year more

questions idas bugs you found don't be shy Pete do you feel comfortable giving a a short pitch of the project you're working on uh sure I've I've been working on this um business problem of invoice verification proving as a client to someone who's financing your invoices by advancing you cash that your invoices are approved and I actually yesterday um

I wasn't sure if it was appropriate for this chat but I did just deploy a verifier that works with a a website called trade shift and I used the system D and log rotate to deploy it to a server and I'm trying to figure out the best ways and I know that we're not ready for production but I am super motivated to get something working that I can start showing clients and one thing I'd like to do is to load test that uh verifier that's sitting out there on digital ocean and see how many clients I could uh throw at it or how many uh MPC sessions I could reasonably throw at it before it starts to tip over um so anyway the business problem is is showing the uh your funders your financers that your invoices are approved without having to have them log

in as you uh the practice traditionally in this business is to uh for you as the client to hand over your passwords and E take a phone call from your funer when they need your MFA code so they can log in as you to do that kind of verification which is of course ridiculous so this is a way to improve improve that process but but back to the tactics if anyone if anybody has any tips on how I could try to um fully being fully cognizant of the fact that I'm running the alpha 5 and and we're not looking to load test anything for production really but I would like to see what I can you know how I could press that verifier and see where I start to have problems if anybody um has any ideas I do I I'm on the uh the TLs

notary server on Discord all the time we don't have to address it here but I would sure appreciate any any tips there thanks yeah I would just set up a um fixture application server we do have one there um in the repo it's TSN server fixture okay and um yeah you'll just want to basically spin up a bunch of concurrent provs that are all just hammering your your um are you running the the notary server how are you running the verifier I mean no it's just the um it's from the interactive prover U I'm sorry the I think it's called the verifier server I could be remembering

that wrong branch in the TLs njs repo and I've modified that that uh it's it's where the appr and the verifier are separated unlike the interactive demo in the main TLS yeah t repo it's that other one so I've I've just got the verifier out there and I run my puer locally from my you know from my Linux machine or my Mac or my windows I have various Pro binaries and then they can hit that verifier out on digital ocean and engage in an NPC session while it's logging into the okay application server yeah yeah I would just um run a um like a application server fixture locally and then uh yeah I mean just just hammer the

verifier is I'm assuming that the verifier is set up to to like accept multiple connections and process things concurrently so yeah if it's ready to do that the only thing you want to avoid I guess is just like hammering like an actual uh like application servers API you don't they probably don't want you like testing just random stuff against them um but yeah like assuming that like the the application the content of the application data itself doesn't actually matter the server server fixture will help you do that it's also the API of it um has some like query parameters for specifying like how much data uh do you want to like emulate so you can set that

to be close to what you expect to actually come from your target applications API and just give it a shot and see what it does um and doing it over over the Internet is probably going to give you the best results we do have some stuff although it's probably not flexible enough for what you want to do for just doing like local network simulation but the only way to like get a real sense of of what like concurrent load is going to feel like for the verifi is to do it like actually over the internet where there's a lot of um like asynchrony there okay yeah that's helpful thank you I was curious if you gred the uh

some of the stuff that we're showing in the extension there um just like the high level idea for I guess the the client side of a of an application story here yes okay I I have right rightly or wrongly I have approached it a little bit differently where and it it would be great to be corrected either here or elsewhere but since the the client process is really supposed to be going out periodically the prover let's say for purposes of this conversation every four hours and and doing a check of invoice status and and U proving that in conjunction with the verifier is it really is more of a background and we talked about this a

little bit at The Hacker House the user experience it's more like running as a tray icon and if something's going wrong it'll turn red um but or whatever whatever you might imagine for the application but there is this need to have a controller or the ability to configure that prover and so what I'm working on right now is an IPC controll old uh rust binary Prov that uh has a little electron app that lets you configure it you know via a guy with the native and then like it goes away the you the user interface user interaction goes away and it shouldn't bother you unless there's a problem with authenticating to the application server so my model's a little bit different it's made me mentally move away from the browser environment but I at the same time I'm totally excited by by what was

shown today so not not to take away from it my head is in just a little bit different space with what I'm developing and it may be that I do go back to the browser that may need to happen yeah no no that makes sense it's a good example of when you don't need something like this plug-in system it's a very application specific thing uh we do hope that the like the verifier side um plugin stuff might end up helping eventually um but uh yeah no no that makes sense to me than more questions or anybody that wants to

pitch the project he's building then maybe you want to talk about the uh hackaton you did yeah sure um so uh so my teammates are here also Bri and Lis and basically I think since a month ago when I started to look into tlsn I started to try to see like what could be built um

I'm still trying to get my head around the the code base I I go and try read a little bit every day to see if one day it you click if still haven't but I think building have been the best way to actually learn a little bit more so uh there was this hackaton and then we thought okay let's try to build something and then the the first um like problem that we saw that uh tlsn could solve was the this um using email proofs to control wallets basically because of VX without having to um I think there are still trust assumptions but I think it's I it felt cleaner to use tlsn so um we use we

created a smart contract wallet that uses um email proof generated by TSN we're still using the interactive flow like we haven't done the like it's not very complex on the TLs tlsn part um and we are using the Google API and basically how the SM contract uh how the smart wallet works is um you just use the email proofs to add or remove signers we didn't want to generate approv every time you send a transaction because that could be a little bit um it could be wor youx then just signing uh with your face ID so we added The secur Enclave um and then for

you to control your wallet you can um use your email proofs to um at a remove sign and also you can send um crypto to non crypto users with just their email which basically we um built an Esco contract where later the user can claim it or or it at least it's automatically claimed once they sign in on on the app so that's the first thing we we thought about and then we were later on also think about what could be next and actually um what we were think thinking to implement and maybe I can ask Su about it is um it was also an extension that would have the like it would be the

wallet itself so the same secure Enclave wallet but a wallet that can also um notorized or basically generate proofs of others data so it would be basically like the tlsn notary extension today uh but with with the the wallet part integrated so basically for the dev he doesn't or the user he doesn't need to open like let's say he wants to sign a transaction that needs a notary proof he wouldn't need to open metamask and then also open a notary um extension so I'm not sure if this some this is something that um the tlsn notary team would be open to implement because I guess being a wallet

is out of the scope but I just wanted to also maybe get some feedback on what you think about it um because I think it's really interesting to to allow users to have everything in one place so when interacting with a adap yeah not not sure if this is good from a pro from a product perspective I do think they they kind of belong to each other like it it be because of wallet in some way is just a way to sign message which is type of proof itself so it's like some kind of proof

credential manager um as a product I think it makes sense um as a users in web 3 I also think it will be very beneficial to be able to access these different kind of proof um or signature from one product um in terms of complexity um I tend to be kind of aggressive when it comes to Evol in complexity um I think it's not that difficult to um to include some well to include a full feature wallet inside the extension um because the web 3 library

is pretty well written and well maintained by this point um there's also many reference implementation of different wallet in the space um yeah that's kind of my opinion yeah uh like one thing that I was um Pro I could say envisioning was um cuz right now um the reason why I think T like I I would literally say like um took my heart like I'm really excited about it uh it's because I feel this is a great tool to build um even better U and web to have today when I when I think better ux is like it's the user flow is as good as it is but it it

allow us to also have features of composability which web 2 doesn't have so it's I I say like it's not that we are trying to get ux as good as web 2 but now better ux than web 2 and from there what I see is the zap wallet would be the first step we like okay people can just on board um just using their email and from like once they created it then they would have something like the coinbase um web wallet or like very very seeming seemingless um integration on the browser where like once they create their email on on the app they go to the browser just with their email everything is connected and they can start generating proofs and interacting with

these naaps um that's something that came to mind um yeah when when when think about like how tlsn could bring us this um better than web 2 experiences so yeah just sharing my thoughts um maybe some we'll try something like this during the eight Brussels um we we want to progress towards um bringing great ux to web 3 so yeah um but I I appreciate um and yeah we'll love to talk more um with with you to you know to to see like where if the TLs tlsn team would be open to doing something like this or like of

course we can always do it there like a separate um project and keep going um yeah yeah awesome yeah which out to me or hendrik yeah we're happy to chat so you will be at eat Global Brussels yes I will be there we are already planning on hacking on tlsn and staying close to guys super I look forward to meet you in person and uh congratulations again on the win thank you it was definitely thanks to all the works you guys put on it cool other user stories or

questions oh there's one in the chat so Ramy asked the Google API uh I think that was just for as an example of um a web page that oh no it was the Google API for the for zap from then uh Ramy maybe you can unmute and ask your question yeah sure can you hear me y yeah yeah hello guys um so I'm curious

about TSN and um experimenting with an extension as well and I got to a situation where I got to do external calls to a certain API and uh I think toini who said uh he's building with mv3 as well and I was curious how to do external calls in uh mv3 because you can't really do those uh because it's restricted because of content security policy it was allowed in mv2 for those of you who got context on on Google extension development but yeah now it's kind of restricted so yeah

I'm basically asking for a work around if there's any thank you yeah what kind of what kind of calls are you trying to make just like regular web requests yeah yeah um just a call to uh an API endpoint yeah so let's say yeah just some Google API yeah so I I share my um manifest Json file you can check in the link um I think think your the issue that you're seeing likely is not just mv3 error um it is probably uh happen in manifest

version two as well um because they actually didn't change that much for Content security um policy the part that they change um with regards to request is the web request blocking um permissions um that that allow extensions to intercept a request and then block it or modify you know what that request is they basically did it so that like it's more difficult to build at blockers um you know for because they're Google um yeah check check out the benest Json if it doesn't work after you kind of like reference it um through the S me or sample C I can um I can take

a look yeah cool cool yeah thank you very much no problem okay anybody else want to add something no okay then I'll just do uh this reminder that uh so we host uh test notary server uh so please use it to test and bootstrap your applications but

uh remember to not build your business on it and then I think we can wrap up so I want to uh thank you all for input and then see you next time think we need to sorry just mentioned one last point that that slipped my mind um so we've released Alpha 6 for the core TLS notary uh Library um the extension if you're using that or if you're using like our TLS njs which technically isn't a public API uh if you are using those things uh we haven't uh done a release for those which uses Alpha 6 just yet um so you might have to be a little bit patient if

you do want to try out Alpha 6 you're you're going to be you can't do it in the browser um but yeah we're we're working out a couple issues right now but we should be able to to get it out soon we're we're targeting next week um but yeah just to let you know if you're if you're pulling up the extension uh make sure that the the the the protocol version that the extension is using which the current one is Alpha 5 uh it matches the version of the notary that you're running so if you're trying to run the a local notary server off of our our main branch that'll be running Alpha 6 so just make sure you check out the alpha 5 t otherwise you're going to run into issues and then yeah back to you

HRI yeah but that was it so thanks again and uh see you next time good see you guys bye bye bye thank you see thank you