Skip to content

Use an application-specific key #2

@strawberrymelonpanda

Description

@strawberrymelonpanda

It looks like the code is calling hashed_id() directly.

Looking at the Security Considerations of the original library, it suggests you should instead generate a unique key baesd on your application, keyed to the user's system.

A machine ID uniquely identifies the host. Therefore it should be considered "confidential", and must not be exposed in untrusted environments. If you need a stable unique identifier for your app, do not use the machine ID directly.

A reliable solution is to hash the machine ID in a cryptographically secure way, using a fixed, application-specific key.

That way the ID will be properly unique, and derived in a constant way from the machine ID but there will be no way to retrieve the original machine ID from the application-specific one.

Using py-machineid it would be something like

id = machineid.hashed_id('ComfyUI-Execute-Python')

Probably not terrible either way, but worth thinking about.
(Unfortunately changing this would breaking any existing workflows)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions