Privacy | EXA appears to "leak" the user device make and model in the `device_display_name` ?

[BillCarsonFr]

EXA will setup the initial_device_display_name like:

• Element X nightly on Google Pixel 5
• Element X on samsung SM-AXXX

This appears to be visible by other users as part of the keys/query unsigned payload.

As a work around it is possible to edit the display name using web.

For comparison, EXI will name the device Element X iOS, legacy android is doing Element Android

[bmarty]

I think that this is coming from OIDC since when using login password, we are providing the value "Element X Android" for the initialDeviceName parameter.

https://github.com/element-hq/element-x-android/blob/develop/libraries/matrix/impl/src/main/kotlin/io/element/android/libraries/matrix/impl/auth/RustMatrixAuthenticationService.kt#L150

@sandhose any ideas?

[sandhose]

Oh, so this is a change in MAS that computes a friendly device name, using a combination of the user-agent and the client name, exposed to the C-S API through /_matrix/client/v3/devices. Looks like /keys/query contains the device display names as well for local users, not federated ones, but that's not specced. I'll check with the rest of the team if we should just phase out that unspecced property

[BillCarsonFr]

not federated ones

It appears to be a synapse config flag allow_device_name_lookup_over_federation

[BillCarsonFr]

maybe this change element-hq/matrix-authentication-service#4459