Device name accessible about theheraldproject.github.io HOT 1 OPEN

iPhone deviceName is always "iPhone" these days. An Apple device advert also exposes the exact model (iPhone9,3) via another characteristic that doesn't require authentication either, without notifying the iPhone's owner to someone requesting it. Apple has a special way of sharing the name (E.g. "Adam's iPhone") that isn't in these characteristics. Also worth reading the two research papers from INRIA in France around Apple and Google Bluetooth device Bluetooth security and tracking. (Especially popets-2020-003). Older iPhones, like the iPhone 6, don't advertise anything unless an app uses Bluetooth. In modern iPhones, if Bluetooth is enabled, they always advertise these services and characteristics.

It's worth bearing in mind that these OS' API allow an app to specify what to advertise, but not to restrict what the OS advertises. So the TxPower and Flags elements in the advert are always there on modern phones, for example, as well as a set of OS specific services and characteristics that an app cannot disable itself.

Also worth noting that the Bluetooth spec deals with an app acting as a peripheral and a central as a single Bluetooth device, with a single Bluetooth MAC address, no matter how the OS' API expose this to an app user. (We use this in our 'connect back' mechanism, for example).

In summary, it's something we do take in to account, but which the OS vendors themselves will have to provide a mitigation for or an API call we can use to restrict such capability.

I'll leave this on the backlog rather than change to a 'wontfix', as we'd love to have an OS API to call to prevent this, but it's just not available today.

from theheraldproject.github.io.