question

Marian Stychuk avatar image
Marian Stychuk asked

Is it safe to expose Profile info to all players?

So, in the game client we need to retrieve a master_account_id from a title_account_id (of another player) and there's no API function for that. We need this for PlayFab Party as it works with title_account_ids, while to retrieve some account info we need a master_account_id (GetPlayerCombinedInfo). After some research, I found a GetProfile API that can return master_account_id from a title_player_account entity, but we need to modify GlobalPolicy to allow this.

My questions are:

  1. Are we overexposing player data with this rule below? Is there a more strict policy we can set, like allowing only to get a lineage of another player?

    {
        "Resource": "pfrn:data--*!*/Profile/*",
        "Action": "Read",
        "Effect": "Allow",
        "Principal": {
            "ChildOf": {
                "EntityType": "title",
                "EntityId": "[Redacted]"
            }
        },
        "Comment": "Allow getting Profiles info for everyone in the Title"
    },

  2. Are there any risks of exposing this info to everyone? Why is it hidden by default?

Attaching a full policy file for additional info: 5361-globalpolicy.zip

Thanks in advance!

data
10 |1200

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

1 Answer

·
Rick Chen avatar image
Rick Chen answered

It is not recommended to expose one player’s profile to other players, as that may also expose the player’s entity file, entity object and etc.

In your case where you are using the Party service, I suggest that you share the master player id to other player using the send data method in Party SDK.

4 comments
10 |1200

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Dmytro Frolov avatar image Dmytro Frolov commented ·

Hello Rick, Looking at party SDK I was not able to find send data method. Did you mean PartyLocalEndpoint::SendMessage?

0 Likes 0 ·
Dmytro Frolov avatar image Dmytro Frolov Rick Chen ♦ commented ·

I'm using PlayFab C/C++ API with UE plugin

Search in plugin/party code for SendDataMessage does not show me anything, so I'm confused here. The underlying library for Unity is the same, right?

0 Likes 0 ·
Show more comments

Write an Answer

Hint: Notify or tag a user in this post by typing @username.

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.