739699 - Change receipt to store user hash not the email

Status: RESOLVED FIXED

(addons.mozilla.org Graveyard :: Code Quality, defect)

Description

[Andy McKay]

Currently we store the email in the receipt and in the Installed model. Let's change that to storing a hash as specified in https://wiki.mozilla.org/Apps/WebApplicationReceipt#the_user_field

Comment 1

[Andy McKay]

Part of the process of validating a receipt on the client is to check the user field against browserid. 

Do we still plan on doing that, it feels like this would break it unless we can let browserid know about the hash.

Comment 2

[Ben Adida [:benadida]]

No, the identity verification is now not part of the receipt verification.

Comment 3

[Andy McKay]

Sold.

Comment 4

[Ian Bicking (:ianbicking)]

Does this mean we won't have any built-in protection against people sharing receipts?

Comment 5

[Ben Adida [:benadida]]

(In reply to Ian Bicking (:ianb) from comment #4)
> Does this mean we won't have any built-in protection against people sharing
> receipts?

The conclusion we came to is that we don't have meaningful built-in protection to begin with, e.g. shared accounts, shared assertions, etc. Once you're copying receipts around, generating shared assertions for bogus shared identities is not that much harder. So the privacy leak of revealing the user's identity by default doesn't seem worth it :)

Comment 6

[Andy McKay]

https://github.com/mozilla/zamboni/commit/31bb4e