Allow to send a direct message (possibly encrypted)

[huguesdk]

First of all, I want to say that I’m very excited by the whole Matrix concept and the projects around it. I think it’s really great. Thanks a lot for the massive amount of work so far.

I’m a fresh user of Matrix and Riot, so sorry if it’s a newbie question, but I wasn’t able to find information about this feature. I’m using a home server set up mainly to communicate with members of my family, as an alternative to (for example) WhatsApp.

It’s working great so far, but I have not found yet a way to directly send a message to a user. All I can do is create a new conversation with that user, which invites the user to a newly created room. But before I can send a message, I have to wait for the user to accept the invitation.

I know that I can already send messages to the room that they would be able to see once they join, if the room is not encrypted, or once #2713 is completed, but until they accept the invitation, they won’t have any notifications for the messages in the room.

Maybe this is by design, but if the idea is to be like email (or SMS, or other popular IM apps), I think that it should be possible to directly send a message to a user (and also to multiple users) of which we know the MXID. I think that not being able to do that is cumbersome and confusing for new users, especially those approaching Matrix as an alternative to other chat apps.

I like the idea of managing everything with conversations/rooms, but then maybe it would be great to have a way to create a new room in which a set of users are directly members of (kind of a force-join) instead of using a 3-step process of inviting, waiting to join (which can last forever), send message.

Currently, each time I tried to create a conversation with a user, I actually had to tell them to accept the invitation by face-to-face conversation, phone call, or SMS (because they didn’t see the notification, or there was no notification).

What do you think?

[t3chguy]

the whole concept is to prevent spam and other such nastiness, so you can't force people to join rooms (unless you run their homeserver)

[huguesdk]

Thanks for your reply. I get the point, but I think enforcing it to this level results in bad UX, and hinders adoption.

Most other communication means are not like this, and most of them are fine in most cases. Anyone can speak to us in the street without first asking “Do you accept to talk to me?”. Or before sending a (paper) letter to someone, we don’t have to send a special letter asking for permission to send them a letter. :) Same for SMS and email. Most other chat apps allow direct messaging, and it’s probably by design, because this is what users expect.

Sure, there is abuse, but in most cases there are ways around this (filters, blocking users, blacklisting phone numbers, not sharing your contact information with everyone,…). Designing for the bad cases is like walking everyday in the street with a helmet, a bulletproof vest and protective clothing. Sure you can do that, but who wants to do that? :) I think that bad cases should be the exception, not the norm (for UX at least).

I agree that explicit consent is great, but in this case I think that it hinders easy communication for most users. Moreover, invitations don’t carry much information. There is no way to add a personalized message to it, for example (but of course this could then be used to spam also). If I receive an invitation from an unknown user, should I accept it?

If we want to prevent abuse, maybe a conversation like this could start in a kind of restricted mode, where the only thing that works is the delivery of messages, but there is no presence information, read markers or typing indicators. In XMPP for example, it is possible to send a message to a user that is not part of our roster. The Matrix client could also notify only for the first message until the invitation is accepted, for example.

It could also be a user option (enabled by default): “Allow direct messages”, that users who want to prevent spam at all cost could disable.

What do you think? Am I the only one thinking that this is missing? :)

[t3chguy]

Not the same for things like Facebook and such though :/
this is more a matrix-doc / riot-meta issue, as it applies to everything consuming Matrix but might get more visibility here

[t3chguy]

in encrypted rooms it could also be a (D)DoS vector, where you can force users to participate in a large quantity of megolm key negotiations

[t3chguy]

plus if you take into account federation it provides a really easy DDoS vector to attack homeservers ;/

(by sending them events for rooms they are not in and that they must accept and process because their users MAY or MAY NOT wish to be force-joined into the room

[lampholder]

The ask here is not unreasonable, but thanks @t3chguy for outlining some of the difficulties.

We would love for there to be a low barrier to engaging with new users, but the problem needs serious consideration - it would be a disaster if work we did in this area exposed users to greater risk of spam.

[akanouras]

Perhaps a setting in the homeserver's configuration that would send a list of suggested homeservers (e.g. ["matrix.example.com", "pbx.example.com", "support.example.com"]) to automatically accept invites from, overridable by the user of course, would be a good, if a bit complicated compromise here.

It would make life much easier for corporate users, administrators, and (I think) gateway implementers.