Config URL observation

[podfeet]

If two people create a configuration with the same settings, the URL will be the same. Now think about using that URL as a bookmark, perhaps synced across browsers, and visible. Does it make sense that this configuration could be reverse engineered?

To prove my point, select the default preset, and then change the max length of the words to 4 characters. The URL created for you will be this:

http://localhost:8080/?c=ZW5nbGlzaCwzLDQsNCxDQVBJVEFMSVNFLFJBTkRPTSxmQSxJVUFrSlY0bUtpMWZLejA2Zkg0X0x5NDcsMiwyLEZJWEVELDgsUkFORE9NLCxJVUFrSlY0bUtpMWZLejA2Zkg0X0x5NDcsMiwy

I'm not convinced this is a problem but it made me tilt my head and think.

[hepabolu]

My observations:

• the hash NEEDS to be reversed engineered, because it’s merely a url-friendly encoding of a specific configuration. Everyone wanting to use this specific configuration would therefore end up with the same hash. Consider it as an id for a specific configuration.
• There is nothing in this configuration that points to a specific person so it cannot leak sensitive information if this url is shared. It becomes more sensitive if the person sharing it indicates it’s his or her personal configuration for all of their passwords.

I personally would change configurations frequently because I store the password I pick from the generated list in my password manager anyway.

[bbusschots]

The problem to be solved here is to encode a config in a url, so the fact that that is what it does is literally a feature not a bug.

It might be worth adding a note to warn people that the URL tells an attacker what settings they use, but other than that, I don't think there is anything more to even consider doing.

[podfeet]

Okey dokey. Just checking.