[Security] Sensitive data stored in unencrypted database

[emikolajczak]

Description:

We have own white label app version based on single-server branch. After our security tests was noticed that Android application uses database to store messages inside server-name-experimental.db.db and this file is unencrypted and sensitive data can be accessed. Did you consider to encrypt this database?

Environment Information:

• Rocket.Chat Server Version: 3.6.3
• Rocket.Chat App Version: 4.11
• Device Name: All
• OS Version: Android

Steps to reproduce:

1. Embedded server-name-experimental.db.db is unencrypted

Expected behavior:

Consider to encrypt this database

Actual behavior:

Embedded server-name-experimental.db.db is unencrypted

Additional context:

[diegolmello]

It's a work in progress on the database lib https://github.com/Nozbe/WatermelonDB/pull/907

[emikolajczak]

Hi, thanks for the reply. Do you plan to implement encryption in rocket app database after implementation in database engine?

[diegolmello]

Sure. It's implemented by default on iOS already.