I'm using a google events tracker like this:
_gaq.push(['_setAccount', 'UA-1422398-23']);
_gaq.push(['_trackEvent', 'BookingRequest', 'Parent Name', $('#parent_fname').val()+' '.$('#parent_lname').val()]);
In this case, let's say I can track how many requests were submitted.. is there a way to track these specific users, and see the traffic source, and if it's Google, then what keywords they searched my website by?
Basically I want to see the people booking online, and see how and where they got me... and hoping there's a better and more elegant way than to have a field that asks "What did you type into Google to find us?"
Putting fname and lname into GA is a violation of Google Analytics terms of service. See number 7 PRIVACY.
Custom vars can be used to determine user type and/or login status. See Session-level Custom Variables
For example, if your website offers users the ability to login, you can use a custom variable scoped to the session level for user login status. In that way, you can segment visits by those from logged in members versus anonymous visitors.
But, don't try to put the username in GA either:
While the username or user ID is not directly PII, if it is used to tie to a person from a backend system…that’s a violation of the Terms of Service.
To see the traffic source of the events, go to Content, Events, select the event you want, and add the secondary dimension of Traffic Source (just above event title in report).
Here is a Custom Report for Event Labels that drills down by source then keyword. Just log into GA and go to the URL.
Related
I have to design an e-learning tutorbot that has multiple possible channels living in parallel:
A live chat (to support learner with FAQ when browsing the e-learning application website)
A IM chat as Telegram (for asyncronous notifications)
An email (for anything else)
...
Take a part the connectors gateway communication logics.
My problem/question is mainly about how to manage user identification.
I want that a user is identified with an unique identifier (call it conversation_id) regardless of channel.
In the mentioned scenario user has one different ID for each channel:
An account_id on the website (e.g. solyarisoftware)
A chat_id on Telegram (e.g. 1234567890)
An email_address (e.g. giorgio.robino#blabla.com)
So, how to let RASA chatbot accept requests coming from the same user (but from different channels)? In other words, how can I map multiple channel IDs into a RASA unique ID, say the conversation_id ?
At the end of the day I need to generate a lookup table that map a UUID with all channel ids. Right?
But is not clear to me what's a good (simple) user experience. At first glance seems to me that that I need a sort of login/registration flow: each time user submit a request on channel X, only for the first time, the user must identify himself somewhere (with his email/account_id?). So by example trough Telegram, when the Telegram connector server receive a /start command, the bot must ask the user email(or account_id), to be able to associate 1-to-1 the TG chat_id with that email. Not perfect in terms of security, I admit.
Any experience/idea/suggestion?
Thanks/giorgio
I don't have an hands-on experience on this but it is something I have been thinking myself for a while.
Indeed the 'merge' of the different accounts (across channels) is something that we need to maintain ourselves, making sure each channel user ID is eventually mapped to a universal user ID (lookup table makes sense to me).
Since you have a website, an email address and multiple channels I would say the assumption is that users first registered on the web site. Each user has a unique email address and obtains an account secured by username/password, as well as a unique secret token.
When chatting on browser (ie Rasa WebChat) you can initialise the plugin with custom parameters (ie userId=1 or token=X), in this case the chat session is assigned to the given user id.
When using Telegram (or other messenger application) I would (at the very first access) ask the user if he/she has already registered. If yes then I would ask the token: this can be used to perform the map and link this Telegram user to the universal user Id. Same approach for other channels.
Depending on your needs you might need to deal with anonymous access (users don't provide the token) or maybe you want to provide a different token for each channel (more secure, but requires more work and an easy way to explain this to users).
Finally something to look at (I haven't tried myself) is the possibility to provide in the web site the option to open Telegram (or others) passing an extra parameter, which would allow you to perform the mapping. I don't know if this is possible, but it would simplify this process for your end users. Or the other way around: the users in Telegram could be provided with a link which opens the website, where they can login and be recognised.
The company I am working at offers a web based calculation tool which has to be paid monthly (a fixed price for a license).
Normally, users go to our website and authenticate themselves with their credentials and then can use the application. When they cancel their subscription they are not able to use the tool anymore, obviously.
Now another company called us because they want to provide our application for their own clients. We have already fixed that they have to pay a license fee for every of their clients. But there is also a restriction: their users should not have to log in on any of our websites (only on the website of our client). But the web application is hosted on our server and is loaded as an iframe.
Now there is that problem that we are not sure whether our client tells us the correct number of people who use our application wherefore we would like to verify that in some way.
One of my ideas is the following:
Our client has to call an API for every users who would like to use our application in order to submit some information like name or an unique ID of that user
When the user would like to access our application, an ID parameter is appended to the iFrame URL
I think that this is not a very good solution because our client could use the same ID for every access and pretend that only one users uses the application. By saving the ip address and id of the accesses it is possible to determine fraud in some cases because ip address will not change frequently.
We even do not have to know WHICH user accesses the application but only the NUMBER of users per month.
I am interested if there is a cryptographic solution where it is hard to cheat. Something like an authentication method which does not require any interaction of the user.
Well you can't. You should require the partner to issue a token for each user so you know they came from the partner.
You could have the partner call an api you expose to issue a one time token for a user and specify user id and IP. You could alternatively have the partner digitally sign such a login request.
If you bill the partner per user, and the partner decitfull he could claim less users.
You can fingerprint the users, you can give long term coockies, you can check IP and fonts installed etc. These will allow you to detect most types of fraud.
If you give a declared userId a cookie and then see him again without it, you assign him a new cookie and then later see the first cookie again while the partner is always declaring same id that is a very strong indicator of fraud.
If I was the decietfull partner I would pair up geographicly close users and merge their IDs. it would look no different from a user with two devices. But this still limits the extent of fraud possible. Two devices per user is plausible. 10 less so.
Find business partners you trust.
Recently google has added multiple user support to the assistant so how would use the API to identify the person by voice?
It depends what you mean by "identify the person".
There is no way for an Action to get the raw audio, so there is no way for it to do voice printing or anything along those lines.
Although each voice has to be reported against a Google User ID, you do not have direct access to that user ID.
What developers do have access to is a UID that is sent along with each request to your fulfillment server. This UID is consistent across requests, although it can be reset by a user (for example, if they reset their Google Home). You can think of this the same way you think of an HTTP cookie - you can track the UID and, if you see it again, have reasonable assurance it is the same user that accessed it last time. This breaks down, however, for the "default" account on Google Home, since anybody who doesn't have an account will map to this user.
Beyond this, you can also use Account Linking to connect a Google Account consistently to an account in your own system. If you have sufficient authentication in place, or are using one from Google or Facebook for example, this can act as an identity.
There isn't an API for developers to identify users by voice.
How can I have access to bigcommerce's %%GLOBAL_CustomerId%% variable?
I create a sample template and logged in with as a user. That variable doesn't show up. Isn't it suppose to be a Global variable?
Background: I want to create an app for bigcommerce that can identify a user base on their customerID. If I can't grab that variable, you guys see any other way to work around this?
It's not immediately clear in the docs, but you can use %%GLOBAL_CurrentCustomerEmail%% anywhere on the template to get the email address of the currently logged in user.
If you need the customer's ID, then you can query the API with the email as a parameter.
Personally, I'd rather "trust" the customer's email as a point of identification, because you never know if the Bigcommerce ID's may get changed or not (example: Customers are deleted and then reimported, now having brand new ID's).
On a subject of security though, you cannot trust client side data, and should attempt to mitigate fraudulent requests through the use of a CSRF token or some similar measure. Otherwise, anyone can send you an email address and receive back a list of that person's favorite products -- golden information for say, a targeted advertising company, or just your suspicious next-door neighbor Joe who seems to always be conveniently checking his mail right when you get home from work, but never says anything when you walk by, not even a wave or a smile, despite the fact that you all have been neighbors for quite some time now. Like, should I say something? Hahaha, I kid I kid.
I am developing a web app for a group, and I want to be able to let anyone in the group create an event and add it to the group's calendar through the app. I was able to get the basic functionality working using Google Calendar API v3 for Javascript -- you could fill out a form with the event's start/end times, title, information, etc, and it could insert that event into the calendar.
But the problem is with authentication. If a user is logged in to a Google account that is not given permission to create events on the calendar, they are unable to add the event (Javascript writes "Forbidden" to the console). If I log out of all Google accounts and then sign in with the account that owns the calendar, the event is created with no problems (that makes sense).
Adding every single person in the group to the edit-permissions on the calendar seems like too much of a "brute force" method.
Is there a way to always authenticate the Google account that owns the calendar? Or, better yet, is there a way just to force authentication in general, even if someone is already logged in to Google / authorized to the app? Some people in the group know the calendar login/password, so if I could always bring up a Google login screen, they could just enter the calendar account information and then add the event from there. Again, I'm using Javascript (not much documentation on this...).
Thanks!
Have a look at Service Accounts. That way the calendar is owned by the application, and so the application will always have permission to update it.
If you want to avoid authentication problem from other opened session in user browser, you have to authenticate on the calendar, using server side library.
check this link:
https://developers.google.com/google-apps/calendar/auth
it bounces you from one article to other, but at the end you should get all information.