iPhone SE (2020) Potential security issue: Can third-party apps and websites view your iPhone’s user-defined name?

[jaxx7]

I logged in to my Google account from the YouTube app on my new iPhone and navigated to “Manage your Google Account” from the app’s settings. In Security > Your devices, I saw my iPhone’s user-defined name (eg: “Zach’s iPhone SE2”) logged in the list of devices used to access my Google account.

The presence of my iPhone's user-defined name in its full glory was a revelation to me, because it has been my assumption all along that Apple, a company that touts privacy as its core value, withholds information that could be used to uniquely identify your device (and by extension, you) from third-party apps and websites, such as your IMEI number, your device’s serial number, your phone number, or – in this case – the appellation you choose to give your phone, which could indeed give you away if you have your real name in it. I created my YouTube account without disclosing my actual name to Google, so I was a bit unnerved to see my iPhone's user-defined name in the Google control panel. I thought my iPhone would show up as “iPhone”, “iPhone SE”, or perhaps even a generic alphanumeric string or a UUID, but no, it showed up as the name I gave it – with my name in it.

I had a chat with Apple Support after this discovery, and the tech support representative (who was a bit hesitant before answering my question, mind you) assured me that Google would not be able to see my iPhone’s user-defined name. The tech support rep's hesitation in answering my question, as well as the absence of publicly available information that pertains to the nature of my question, has left me thoroughly unconvinced of the veracity of their response. If I can see my iPhone’s user-defined name in the control panel of my LAN’s router when I am connected to the LAN, then it makes no sense for Google to not be able to see it – least of all if the name of my iPhone is quite literally listed in Google’s control panel!

So what is the truth? Is this information divulged to third-party apps? Is it freely transmitted to them? Would we be better off with alphanumeric strings as user-defined names? We have no way of knowing at the moment.

 

[ian87w]

Every network device has to have identification. Since this is user controlled, I don’t see this as an issue. You can simply name yours as a generic “iPhone” or some random number.

There are more metadata that a website gets from a device, like public IP address, browser types, etc. That’s just the nature of networking.

 

[jaxx7]

Every network device has to have identification. Since this is user controlled, I don’t see this as an issue. You can simply name yours as a generic “iPhone” or some random number.

Sure, but it still doesn't answer my question.

 

[Nermal]

As far as I'm aware, websites aren't able to access the name. However, apps can, so the YouTube app has presumably sent that information to Google.

 

[jaxx7]

As far as I'm aware, websites aren't able to access the name. However, apps can, so the YouTube app has presumably sent that information to Google.

It does make sense. If other people can see the name of my phone if I switch personal hotspot on or make myself discoverable to everyone in the vicinity via AirDrop, then I don't see why Google can't.

Such a simple answer needlessly complicated by Apple's befuddled tech support reps.

Now if only Apple could give us the ability to mask the names of our devices when using these apps. Alphanumeric strings as names suck, especially if you use AirDrop a lot.

 

[Zazoh]

In poking around a bit you can turn off name and email sharing in iCloud. (Not the same as your situation)

Prevent apps from showing your name on iCloud.com

Prevent iOS, iPadOS, and macOS apps from showing your name and email address.

support.apple.com

But, Apple allows opting out, after the fact, or during the on boarding phase of things. I checked mine for similar situations and my device name is listed as I have it listed.

At the very least, to your point, Apple should specify not to include PII in that field which is shared with Bluetooth connections, CarPlay etc.

As I programmer, there is an API that I can use to get your GPS location from a browser. When I do this, you get notified and asked if you want to share your location. Many apps put this in the user agreement instead. Apple allows it to be turned off, but most don’t. When it comes to privacy, to me, Apple allows you to turn off as much as is legally possible. It’s the 1% legal that ultimately trips us up.

 

[freeagent]

If my router can see the name of every device connected, the internet can see the name you chose for your phone..