Skip to content

Improve Live Chat Anonymous Naming #11999

@martig7

Description

@martig7

What problem are you trying to solve with Submitty
Currently anonymous names are chosen using a combination of user id, chatroom id, host id, and chatroom session start time. There was some debate on how bad that is, so we might as well make this anonymization better in any way we can. Additionally, we should make sure that duplicate anonymous names within a chatroom can't exist, and that there are enough anonymous names that can be generated to not have this be an issue.

Describe the way you'd like to solve this problem
There's a function called calcAnonName in the Chatroom.php file. We can choose more difficult components to guess to be part of the calculation, or change the calculation altogether. One suggestion I have is to perhaps use the users' CSRF token. Whatever way it's implemented, it must be retained on chatroom leave and enter at the very least, and is preferably difficult to change by clearing cookies/logging in and logging out, which means CSRF might not be the way to go. As for preventing duplicate chat names and being able to generate more chat names, that's up to the person implementing this.

Describe any potential alternatives you'd tried to solve the problem
As the person who implemented the original feature I at first used just the user_id and the chatroom id to generate it, but I realized that this is easily reverse-engineered and non-specific to each individual chatroom, as different chatrooms in different courses can have the same chatroom id.

Additional context
This is low priority because anonymous names being really secure is not of major concern.

A Bonus feature would be a button in the chat editor to regenerate anonymous names, which could just update the Session start time to be current.

Note:
For future PR's which attempt to resolve this issue, we should make sure that randomized naming is addressed, instead of just mitigating anonymous name collision. Consider utilizing the way anonymous IDs are done for students in gradeables where those IDs are not computed from attribute of the student. This way, Live Chat can generate and fetch anonymous names.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions