How risky is it to share a .blend file?
Does it hold a variable some where with your computer name?
If Blender is installed through Steam does it hold your Steam username as a variable somewhere in your blend files?
I searched around and couldn't find any information about this. If this is the case, how can I remove my personal information from the project file.
How risky is it to share a .blend file?
In general not very risky, meaning, as your question implies, how much Personally Identifiable Information (PII) you would expose if you transmitted a copy of a blend file to a third party, such as, for instance, uploading it to blend-exchange.
Note that in the US, PII has a specific legal definition "Any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means."
Other jurisdictions have similar legal concepts but with slightly different definitions.
Does it hold a variable some where with your computer name?
Not in general. While it is sometimes possible to infer a computer name from the paths that are sometimes stored in a Blend file, it is usually not included in a path.
However, it might be possible to deduce a user name from a path, because most operating systems use the user's username in the path to the 'home' directory. If you worry about such things, select a user name that doesn't identify you.
If Blender is installed through Steam does it hold your Steam username as a variable somewhere in your blend files?
No. That's not how Steam keeps track of your account information. It would require that they modify Blender to add that ability, and that's not in their interest.
However there is one potential source of risk: add-ons. I know of at least two add-ons (Blender Cloud ID, and Blenderkit) that keep copies of your account credentials so that you don't have to manually log in each time you use them. There are probably others.
Well written add-ons will keep that information in separate files that the add-on accesses so that it's never stored in the blend file; but there's nothing to keep a poorly written add-on from also keeping the information as plain text in text data block in the blend file.
Nor is there anything to keep you from doing the same thing yourself.
You can reduce risk by storing your blender files on a path that's not part of your 'home' directory, and by avoiding add-ons that use login credentials, but it's a pretty low risk to begin with.
.blend file that I created (I used strings to find it). Do you have any idea how to remove that reference? I have already made texture file references relative, instead of absolute, but it did not remove this particular dir reference.
$\endgroup$
Commented
Sep 19 at 12:41
No, I would not count on .blend files to be safe from PII (Personally Identifiable Information), nor would I feel safe opening a .blend file whose origin I did not trust (e.g. downloaded from a trusted domain or given to me by my best friend).
To investigate whether or not the file contained a string related to my username (which frequently shows up in file paths) I ran the following:
strings cool_thing.blend | grep -i '/'
Scanning the output quickly revealed that yes, sadly there was a path in there that contained half of my username... for some reason it was split. But this already gave me enough confidence to not rely on blender as being "clean of PII" when used OOTB.
Here is a link to read more about the strings program.
For security, let's say I wanted to open a random .blend file that I'm not sure where it came from, I would actually be somewhat wary. Blender has security measures to prevent automatic execution of python scripts, and so for most use cases I would be fine with it. So unless you enable this, it shouldn't be a big worry in the sense that it "gives you the time to read over the contents of the python scripts before you execute them". However, most people probably don't care about this, and maybe find it annoying to have to click an extra button to enable scripts for their files, and most files are probably created without malicious intent, and going through a .blend file is probably not the most efficient "attack vector" either. Everything is relative however, and you can really never be 100% safe. (I'm fully ok running both Blender & opening random .blend files I find on the web on my own personal / hobby computer :) )
