Anonymizing User's Position Information

by 0xb8782cf628357ce2751a4ea3007934048fbaa672 (deadpool#a672)

Linked Pre-Proposal

Prevent harassment and surveillance of all users via overly-exposing endpoint

Summary

To safeguard users' privacy, stop exposing their wallets with their current positions; instead, utilize anonymized session IDs to prevent public identification of user locations within the platform.

Abstract

There were extensive and heated debates regarding the disclosure of users' wallets with their current positions. Ultimately, the decision was made to maintain open data, leading to the emergence of new wallet analytics apps in Decentraland. However, the fact that anyone could get a detailed analytic dashboard with users names and activity for any wallet raised concerns about data privacy breaches, causing discomfort and preoccupation about privacy safeguards.

Motivation

A misalignment exists between Decentraland's data privacy policy, which has raised user concerns, and the potential conflict regarding the disclosure of user behavior.

Specification

Catalyst's communication server exposes API endpoints that broadcast user wallets and real-time locations, enabling anyone to:

• Track user movement: This data can be used to create user behavior analytics, potentially revealing specific user habits and routines.
• Facilitate harassment: Malicious actors could exploit this information to harass other users on the platform.
• Lack of opt-out: Currently, there's no way for a platform user to prevent their wallet address and location from being displayed in the API results.

Proposed Solution: Balancing Transparency and Privacy with Anonymouse Session IDs and Metrics

While recognizing the value of public platform metrics and analytics, an alternative approach can address privacy concerns. Instead of removing the endpoint entirely, wallets could be replaced by anonymous session IDs. Here's how it would work:

1. Session ID Generation: Whenever a user connects to Decentraland, a unique and anonymous session ID is generated.
2. Replacing Wallets: This session ID would replace the user's wallet address in all API responses.
3. Unlinkable Sessions-Wallet: Since new session IDs are generated for each connection, linking them back to specific user wallets would not be possible.

This API change will come along a new endpoint to help scenes validate users' positions, the operation will be as follows:

• Input: This API would accept a user's sessionId or wallet and a specific range of parcels within the scene.
• Output: The API would respond with a simple "true" or "false":

True: indicates the user is present within one of the specified parcels. False: indicates the user is not present in any of the queried parcels.

This approach offers a balanced solution. Public platform metrics can still be obtained for analytics purposes and scenes will still be able to validate user’s positions while privacy is protected by anonymizing user data through session IDs.

Conclusion

The proposed solution balances transparency and privacy by replacing wallets with anonymous session IDs. This approach maintains the value of public platform metrics and analytics while safeguarding user privacy.

This proposal is summarized due to technical limitations. To view it complete and vote on it, visit the DCL DAO Governance dApp