1387364 - Add Safe browsing Unique ID stable over a week or two

Status: NEW

(Toolkit :: Safe Browsing, enhancement, P3)

Description

[Thomas Nguyen (:tnguyen)]

Opt-in report may require a unique ID which will be refreshed every 1-2 weeks.
We should:
- Create two new prefs: user id and user id timestamp to manage the ID and its lifetime
- Refresh the ID if the timestamp >= 2 weeks (when initializing SB or about to send report)

Comment 1

[François Marier [:francois]]

Here's a very simple scheme:

1. create a permanent UUID if it doesn't already exist (like toolkit.telemetry.cachedClientID but not the same)
2. store that permanent UUID in "browser.safebrowsing.provider.google4.datasharing.id"
3. concatenate the userid with year and week number in YYYYWww format [1] (e.g. 2017W05)
4. hash the concatenated string
5. send the hash as the userid

The advantage of this scheme is that we don't have to manually rotate the ID and it's guaranteed to be different every week.

[1] https://en.wikipedia.org/wiki/ISO_week_date

Comment 2

[François Marier [:francois]]

The user_id will be added to the ClientReport API like this:

  // Details about the user that encountered the threat.
  message UserInfo {
    // The UN M.49 region code associated with the user's location.
    optional string region_code = 1;

    // Unique user identifier defined by the client.
    optional bytes user_id = 2;
  }

  // Details about the user that encountered the threat.
  optional UserInfo user_info = 22;