White/black lists for relays

[staab]

• Global setting for what to do when connecting to a relay not on the user's list: always, never, confirm (default)
• Global setting for whether to auth with unknown relays: always, never, confirm (default)
• When authing with a new relay, ask user permission based on the global setting and add to auth whitelist
• When selecting relays, penalize relays that the user hasn't connected to, or that have been blacklisted
• Show notification on relays navigation item when relay approvals are pending
• Redesign relays page or HUD to include advanced settings for relays
• Use welshman/thunk instead of publishes
• Measure invalid or muted events getting returned by relay, if the rate is significant warn the user somehow

[dtonon]

Are we sure we want to have the confirmation action as the default for the connection? It can disrupt the functionality and be quite annoying for a standard user; we tested this with Gossip when it added this confirmation option.
For login, on the other hand, a more rigid default setting may be fine, as the user attests to identity and there should be fewer requests for confirmation.

An additional solution is to add to the onboarding a "Privacy / security" step where the user in formed about these possibilities and can tune the preferences.

[staab]

Are we sure we want to have the confirmation action as the default for the connection? It can disrupt the functionality and be quite annoying for a standard user; we tested this with Gossip when it added this confirmation option.

I agree. I think the kind of chatty confirmation signers do is an anti-pattern, and we shouldn't duplicate it if at all possible for relay connections. Reasonable defaults and a few different modes based on user paranoia would allow us to reduce the friction for normal users, so that we're only asking for the sketchiest of relays (relays completely outside their network for example).