[AltspaceVR] User ids are not consistent across multiple instances of the same app session.

microsoft / mixed-reality-extension-sdk

The Mixed Reality Extension SDK enables developers to build 3D world extensions for AltspaceVR, using Node.JS.

MIT License

142 stars 61 forks source link

[AltspaceVR] User ids are not consistent across multiple instances of the same app session. #129

Open eanders-ms opened 5 years ago

eanders-ms commented 5 years ago

In a space where an MRE is instantiated multiple times with the same sessionId, a given user in the world will have a different userId in each instance. Expected: The users will have the same userId in all instances.

When making this change, multiple other systems must be adjusted to compensate:

Class UserRPC must send rpc messages down all connections this user has made to the session.
New events on Context: onConnect(connectionId: string, userId: string), onDisconnect(connectionId: string, userId: string).
New RPC class ConnectionRPC. Sends/receives rpc messages on a single connection.
Update MRETestBed to match new userId generation behavior.

sorenhan commented 5 years ago

Another change that needs to happen when this feature is done: VideoPlayerManager must be updated to use onconnect and ConnectionRPC

stevenvergenz commented 5 years ago

@eanders-MS This is by design. GDPR requires us to not allow users to be tracked without their permission. As such, any given Altspace user will be assigned a different ID for each instance of a given app. I agree that a persistent ID per app would be tremendously useful, but we have to come up with a strategy to protect our users' privacy first.

eanders-ms commented 5 years ago

I think the design we landed on was:

Registered apps: Same userId for a given user across multiple instances of an app (because the AppId is consistent).
Unregistered apps: Different userIds for a given user across multiple instances of an app (because the AppId is derived from the space component id).

For privacy / right to be forgotten: We talked about adding functionality on the website for users to be able to be forgotten by all apps. How this would work: When generating the userId, include a key taken from the user record. When the user chooses to be forgotten, we would roll this key, effectively assigning them a new userId in all apps.