Bug 496901

Summary: Neochat leaks information about user's device
Product: [Applications] NeoChat Reporter: Anna <cyber+kde>
Component: GeneralAssignee: Tobias Fella <fella>
Status: RESOLVED FIXED    
Severity: major CC: carl, josh
Priority: NOR    
Version First Reported In: 24.08.3   
Target Milestone: ---   
Platform: Other   
OS: Linux   
Latest Commit: https://invent.kde.org/network/neochat/-/commit/64c5ad88f6d0e1828114d945fb9269dd1fb8c160 Version Fixed/Implemented In: 24.12
Sentry Crash Report:

Description Anna 2024-12-01 19:26:50 UTC 
SUMMARY
NeoChat leaks the following metadata in the *public* device ID:
- Hostname
- OS name and version
- CPU architecture

This can be enough for bad actors (like stalkers, scammers and authoritarian governments) to deanonymize a user.

This puts users who rely on Matrix for secure communication at risk.

STEPS TO REPRODUCE
1. Log in with NeoChat

OBSERVED RESULT
Default device ID is:
"NeoChat sysrq.in gentoo 2.14 x86_64"

EXPECTED RESULT
Default device ID is just "NeoChat"

SOFTWARE/OS VERSIONS
Operating System: Gentoo Linux 2.17
KDE Plasma Version: 6.2.3
KDE Frameworks Version: 6.7.0
Qt Version: 6.7.3
Kernel Version: 6.12.1-gentoo (64-bit)
Graphics Platform: Wayland
Processors: 8 × AMD FX-8320E Eight-Core Processor
Memory: 11.6 ГиБ of RAM
Graphics Processor: NVD9
Comment 1 Anna 2024-12-01 19:30:24 UTC 
Commit that introduced this privacy issue:
https://invent.kde.org/network/neochat/-/commit/6b86c113f449056625916e24e251118d94f6251a
Comment 2 Bug Janitor Service 2024-12-01 19:41:22 UTC 
A possibly relevant merge request was started @ https://invent.kde.org/network/neochat/-/merge_requests/2032
Comment 3 Carl Schwan 2024-12-02 16:05:46 UTC 
Git commit 9d887ba3e726e024797684b9311bb1c793302470 by Carl Schwan, on behalf of Tobias Fella.
Committed on 02/12/2024 at 15:50.
Pushed by carlschwan into branch 'master'.

Remove system information from device display name

M  +1    -2    src/login.cpp
M  +1    -4    src/registration.cpp

https://invent.kde.org/network/neochat/-/commit/9d887ba3e726e024797684b9311bb1c793302470
Comment 4 Carl Schwan 2024-12-02 16:08:00 UTC 
Git commit 64c5ad88f6d0e1828114d945fb9269dd1fb8c160 by Carl Schwan.
Committed on 02/12/2024 at 16:07.
Pushed by carlschwan into branch 'release/24.12'.

Remove system information from device display name


(cherry picked from commit 9d887ba3e726e024797684b9311bb1c793302470)

Co-authored-by: Tobias Fella <fella@posteo.de>

M  +1    -2    src/login.cpp
M  +1    -4    src/registration.cpp

https://invent.kde.org/network/neochat/-/commit/64c5ad88f6d0e1828114d945fb9269dd1fb8c160