Device name leaks personal information

[axelsimon]

Hi,
Currently, the riot/matrix device name by default for iOS users is “bladibla's iPhone”. Most people will put their first name, some will even put their full name, resulting in an iPhone device name that leaks personal information.

If one picks a Matrix username with the idea of separating that identity from their legal/usual name, their actual name will be easily accessible simply by looking at their list of devices.

I suggest Riot either doesn't name devices according to the iOS device name. Maybe use a random identifier, or ask users to pick a name for this device.
Alternatively, I suggest Riot warn users clearly that their Matrix device name will be that of their iOS device, leaking this information. This second solution is not as good in my mind.

And in any case, asking for user interaction to pick a device name is not a good idea either.

Hope this helps in any case.

[axelsimon]

I'll add this is likely less a problem on Android, as Android devices get assigned a random name, android-(randomtalphanumericalstring).
It not likely to be be an issue on web, where the name is in the format https://riot.im/develop/ via Firefox on Linux.

[manuroe]

Thanks for the report and UX suggestions. We need to manage this leak better.

[richvdh]

see also https://github.com/vector-im/riot-web/issues/2295, where this issue has been discussed for the web client.

[manuroe]

Note that in Riot 0.3.8, you can rename and delete a device when clicking on it from the devices list on the settings page:

[giomfo]

related to element-hq/riot-meta#12