search

RocketChat / Rocket.Chat

The communications platform that puts data protection first.
https://rocket.chat/
Other
40.47k stars 10.54k forks source link

"Go full featured" not GDPR-Compliant #25296

Open jfqd opened 2 years ago

jfqd commented 2 years ago

Description:

The new Admin page "Go full featured" is not GDPR-Compliant. This page makes requests to several third party hosts.

I fully understand your goal with this page, but please make it GDPR-Compliant and server the assets from the Rocket.Chat instance directly. Or give us an option to deactivate this page to be able to use it leagally in europe.

Steps to reproduce:

  1. Open the Admin area
  2. You see the new "Go full featured" page

Expected behavior:

I expect no requests to third-parties.

Actual behavior:

Currently this page makes commections to the following hosts, which is not GDPR-Compliant:

Server Setup Information:

Client Setup Information

Additional context

Relevant logs:

Gummikavalier commented 2 years ago

This is particularly mean as the users accessing admin features most often are just that; admins, and the page opens up every time you access the admin console via the user menu.

This allows pinpointing both RC instances as well as their maintainers in the world.

In the worst case scenario the 'Go fully featured' page would be used to load malware directly into the admin user session on the browser using 0-day vulnerabilities in the browsers.

The simplest workaround is using the url /admin/info instead of the profile menu to access the admin console.

jfqd commented 2 years ago

Thx for the workaround, but the url /admin/info is nothing someone can open in the Roket.Chat client. Rocket.Chat is not GDPR-Compliant as long as this feature is alive.

Gummikavalier commented 2 years ago

I completely agree with you on all accounts.