On my school website I can list all existing accounts in the system to send them a message. Each account has a logo showing the user role (admin, professor or student) and I can directly filter on it.
As I know some of these peoples are likely to click on a link I send them via chat. Is it a bad security practice ?
Or the act to hide the roles only adds a minimal effort to threat actor ?
Is it a bad security practice ?
For me this looks like the common trade-off between usability and security.
Hiding or obscuring information can help in security - sometimes a bit and sometimes a lot depending on how valuable these information are actually for the attacker and how easy they are to obtain in other ways.
But hiding or obscuring information also makes it harder for the intended user (i.e. not the attacker) and might greatly impact usability and indirectly the value of the system for the users. This might lead them to use other systems which are more convenient to use, this way bypassing the intended (and maybe monitored) processes - i.e. shadow IT. In other words: attempts to increase the security by decreasing usability might actually backfire and at the end reduce both usability and security.
In a case like this, I don't really see how hiding the user level would help. Sure, you could give everyone the same icons and not display it there - but you can't hide their actual role in the organisation - because people need to know who other people actually are.
The list of professors within the organisation isn't really something that you can keep secret, and you can probably find out what most other people do either internally, or just by looking at their profiles on sites like LinkedIn. Even if you do hide the icons for staff, when someone's job title is "Head of IT", or "English Literature Professor" then you can have a pretty good guess about the type of user account they have.
So ultimately you're going to make making the system less user-friendly for no real security gain.
