Improve data available for product analysis

[brave]

Improve data available for product analysis

[mrose17]

Room names are generated algorithmically by the client to have 256-bits of pseudo-entropy; however, as long as the name conforms to the syntax (43 characters, base64), it will be accepted by the system. we purposefully decided not to facilitate "vanity names", though a few of us old-timers use them.

so, it's possible to have collisions, but probably not worth worrying about.

[thypon]

The change seems solid to me from a security standpoint.
To be completely honest I think the room_name should be considered a sensitive information as well, from a privacy standpoint. Is there any use for that particular name? Have you considered saving an identifier based on the room_name?

Something like hash(room_name + nonce) will provide us with a unique identifier without leaking sensitive information such as the organization using the service in our logs.

[tackley]

Something like hash(room_name + nonce) will provide us with a unique identifier without leaking sensitive information such as the organization using the service in our logs.

That sounds like an excellent idea @thypon, we have no need or desire to know the actual room_name. Have updated the column above.

[thypon]

What's the status for this issue?

[tackley]

Upon reflection, we realise that using a genuine nonce - i.e. regenerated every time - as part of the room_identifier would mean that we couldn't track the usage of the room over time, a key aim of this dataset.

So we propose using a salt that is rotated every 2-3 months instead (or possibly monthly, but no less), which would allow us to track room usage accurately over a monthly period, but still prevent longer tracking. i.e. room_identifier = hash(room_name + salt).

Does that sound acceptable @thypon @orspetol @kdenhartog?

[mrose17]

I like this plan. Let's start at 3 months and we can always drop it to two. This should give us a good balance!

[kdenhartog]

How is the room_name provided? My theoretical concern with this design is that if the room_name is user controlled two unique users could select a common room name such as test and it would throw off the metrics here if they're generated with the same salt in use.

[kdenhartog]

Sounds good, I don't see any issue with this approach.

[orspetol]

+1 this is fine from my end.

[mrose17]

Closed as the goals can not be easily realized given the privacy concerns.