-
Notifications
You must be signed in to change notification settings - Fork 2
Description
It looks like the code is calling hashed_id() directly.
Looking at the Security Considerations of the original library, it suggests you should instead generate a unique key baesd on your application, keyed to the user's system.
A machine ID uniquely identifies the host. Therefore it should be considered "confidential", and must not be exposed in untrusted environments. If you need a stable unique identifier for your app, do not use the machine ID directly.
A reliable solution is to hash the machine ID in a cryptographically secure way, using a fixed, application-specific key.That way the ID will be properly unique, and derived in a constant way from the machine ID but there will be no way to retrieve the original machine ID from the application-specific one.
Using py-machineid it would be something like
id = machineid.hashed_id('ComfyUI-Execute-Python')
Probably not terrible either way, but worth thinking about.
(Unfortunately changing this would breaking any existing workflows)