No password required on Linux (AppImage)

[sterliakov]

I don't know whether it should be considered a bug report or feature request, because it is not mentioned in docs, but is (for me, at least) obviously necessary.

I'm able to open the wallet and see my address, balance, and transaction history without password prompt. Is it the expected behavior or a serious bug? I'd say it is the latter, because this gives anyone (even with non-admin privileges) full view access to my wallet.

I understand that blockchain can be explored to view all transactions and a balance of an address - but it is hard to link an address and its owner. Ability to open the wallet and view the address that belongs to me makes this step trivial on even slightly compromised system. This should be password-protected, isn't it? This privacy leak actually prevents me from using this wallet now.

Please tell me - is that intended? If not, then I can provide any other useful details to troubleshoot this (and take part in implementation of this "feature" if needed).

Debugging info

• App source used: .AppImage v2.0.3; sha512-b64 Rb17v3pgnV2udFR5T44wFaBxkD1d+Gs0wUddvJZ/mcHUTmeH2QyTHdobt1ERvCAKr8cnLA5WB/yaebI2/xSNyw==; size 82658997 bytes, downloaded from releases page
• System: Ubuntu Impish (21.10); Linux pc 5.13.0-51-generic #58-Ubuntu SMP Tue Jun 14 03:23:07 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

Steps to reproduce

• Download AppImage, verify checksum. I'm using /usr/appimages to keep app images, so:

cd /tmp
wget https://github.com/vechain/sync2/releases/download/v2.0.3/Sync2-linux-x86_64-2.0.3.AppImage
diff <(openssl dgst -binary -sha512 Sync2-linux-x86_64-2.0.3.AppImage | openssl base64 -A) <(printf %s 'Rb17v3pgnV2udFR5T44wFaBxkD1d+Gs0wUddvJZ/mcHUTmeH2QyTHdobt1ERvCAKr8cnLA5WB/yaebI2/xSNyw==')
mv Sync2-linux-x86_64-2.0.3.AppImage /usr/appimages/sync2.AppImage

• Open an app for the first time, set up a password, go through backup process for new wallet.

/usr/appimages/sync2.AppImage

• Close an app (doesn't matter: with a button, with Alt+F4 or with Ctrl+Q)
• Open an app again with the same command. Look at your wallet, click at "view address" icon, cry. Click at "transactions" icon for any asset, cry again.

[sterliakov]

(not related, but too small for another issue)

It would be great to add checksum to download page on main site. For stuff like this wallet, I suppose many Linux users want to verify the checksum - and now we should go to github releases page to find it.