Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

`pushers` table contains user device names, which may include user real names #5830

Open
reivilibre opened this issue Aug 8, 2019 · 2 comments

Comments

@reivilibre
Copy link
Contributor

commented Aug 8, 2019

The device_display_name column in pushers may be considered to contain personally-identifiable information.

Specifically, on my homeserver (which consists mostly of my real-life friends), I observe:

  • RiotX/Andoid device_display_name corresponds to a devices.device_id – probably not PII or an issue
  • Riot/Android device_display_name typically corresponds to a model of Android device — e.g. 'Moto G (5)'
  • Riot/iOS device_display_name typically corresponds to '<user's real name>'s iPhone'
    • Usually just first name, but in one instance, also their last name.
    • It does not always correspond to this – it seems to be user-configurable as one of them is a bit of a funny string that has almost definitely been typed in by my friend somewhere
    • I am not an iOS user so cannot really comment.

Do note that this is not the same as the devices table – I'm not sure if these device_display_name are displayed anywhere to users in actual Riot clients.
It can, however, be pulled out with the GET /_matrix/client/r0/pushers.

With that in mind, it seems like it might be an issue belonging to clients rather than Synapse, but it's perhaps worth thinking about. In general, I would personally prefer to keep personal information (that hasn't been end-to-end encrypted) out of my database. It is my suspicion that users aren't aware that this information is being transmitted, and are not being given the choice to remove it.

@anoadragon453

This comment has been minimized.

Copy link
Member

commented Aug 8, 2019

I think the iOS case is the iPhone's name, which can be set in General>About (last time I used iOS anyways).

Most likely not entered on in Riot iOS.

@neilisfragile

This comment has been minimized.

Copy link
Contributor

commented Aug 8, 2019

If we don't use it for anything then we should remove it. Need to confirm that it really is redundant.

@neilisfragile neilisfragile added this to Holding Pen in Homeserver Task Board via automation Aug 8, 2019
@jryans jryans added phase:3 and removed phase:2 labels Sep 27, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Homeserver Task Board
  
Holding Pen
4 participants
You can’t perform that action at this time.