5
$\begingroup$

How risky is it to share a .blend file?

  1. Does it hold a variable some where with your computer name?

  2. If Blender is installed through Steam does it hold your Steam username as a variable somewhere in your blend files?

I searched around and couldn't find any information about this. If this is the case, how can I remove my personal information from the project file.

$\endgroup$
7
  • $\begingroup$ 1st: It shouldn't because blender doesn't require you to make an account to use it. It doesn't even ask for any personal information, so blender shouldn't have that stored anywhere at all. 2nd: I'm not sure how you would install a blend file onto steam, but I guess if you did, maybe it would store that, I'm not entirely sure, but even if it did, I think you would be at an incredibly low risk of getting your information stolen, if there was any risk at all. $\endgroup$
    – ETHAN DAY
    Mar 8, 2021 at 0:16
  • $\begingroup$ By installing a blend file on steam I meant "installing blender on steam" my bad $\endgroup$
    – Retard Boi
    Mar 8, 2021 at 0:20
  • 2
    $\begingroup$ If I understand correctly, OP isn't concerned with opening an untrusted .blend file. He is concerned about information leaking from his PC to others through his .blend file that he shares. If I'm correct, the duplicate flag is wrong, and when it comes to the answer, I think Blender doesn't do anything unusual in this regard, so it may be a better idea to ask more generally, on security.stackexchange.com what kind of information leaks through documents when you share them. Folder names rather don't store sensitive information, so maybe only anonymity (fingerprint) is an issue. $\endgroup$ Mar 8, 2021 at 0:44
  • 1
    $\begingroup$ Even an empty .blend contains paths to where it the .blend was saved and other locations that may contain personal info. You can open it a hex editor and search for your user name/Steam name. $\endgroup$
    – scurest
    Mar 8, 2021 at 2:19
  • 1
    $\begingroup$ cleaning up here: blender.stackexchange.com/questions/8407/… $\endgroup$ Dec 6, 2021 at 1:10

2 Answers 2

3
$\begingroup$

How risky is it to share a .blend file?

In general not very risky, meaning, as your question implies, how much Personally Identifiable Information (PII) you would expose if you transmitted a copy of a blend file to a third party, such as, for instance, uploading it to blend-exchange.

Note that in the US, PII has a specific legal definition "Any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means."

Other jurisdictions have similar legal concepts but with slightly different definitions.

Does it hold a variable some where with your computer name?

Not in general. While it is sometimes possible to infer a computer name from the paths that are sometimes stored in a Blend file, it is usually not included in a path.

However, it might be possible to deduce a user name from a path, because most operating systems use the user's username in the path to the 'home' directory. If you worry about such things, select a user name that doesn't identify you.

If Blender is installed through Steam does it hold your Steam username as a variable somewhere in your blend files?

No. That's not how Steam keeps track of your account information. It would require that they modify Blender to add that ability, and that's not in their interest.

However there is one potential source of risk: add-ons. I know of at least two add-ons (Blender Cloud ID, and Blenderkit) that keep copies of your account credentials so that you don't have to manually log in each time you use them. There are probably others.

Well written add-ons will keep that information in separate files that the add-on accesses so that it's never stored in the blend file; but there's nothing to keep a poorly written add-on from also keeping the information as plain text in text data block in the blend file.

Nor is there anything to keep you from doing the same thing yourself.

You can reduce risk by storing your blender files on a path that's not part of your 'home' directory, and by avoiding add-ons that use login credentials, but it's a pretty low risk to begin with.

$\endgroup$
1
$\begingroup$

TL;DR

No, I would not count on .blend files to be safe from PII (Personally Identifiable Information), nor would I feel safe opening a .blend file whose origin I did not trust (e.g. downloaded from a trusted domain or given to me by my best friend).

Why not?

To investigate whether or not the file contained a string related to my username (which frequently shows up in file paths) I ran the following:

strings cool_thing.blend | grep -i '/'

Scanning the output quickly revealed that yes, sadly there was a path in there that contained half of my username... for some reason it was split. But this already gave me enough confidence to not rely on blender as being "clean of PII" when used OOTB.

Here is a link to read more about the strings program.

security

For security, let's say I wanted to open a random .blend file that I'm not sure where it came from, I would actually be somewhat wary. Blender has security measures to prevent automatic execution of python scripts, and so for most use cases I would be fine with it. So unless you enable this, it shouldn't be a big worry in the sense that it "gives you the time to read over the contents of the python scripts before you execute them". However, most people probably don't care about this, and maybe find it annoying to have to click an extra button to enable scripts for their files, and most files are probably created without malicious intent, and going through a .blend file is probably not the most efficient "attack vector" either. Everything is relative however, and you can really never be 100% safe. (I'm fully ok running both Blender & opening random .blend files I find on the web on my own personal / hobby computer :) )

$\endgroup$

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .