Blockstack Browser For Mac leaks "Core API Password" to 3rd parties

How it was found

Hi Blockstack! 😃 I noticed that BlockStack Browser for Mac version is leaking the CoreAPIPassword via Referer Header to several websites:

• appco.imgix.net (a third party site!) F471236
• api.app.co (seems to have some blockstack affiliation?) F471235
• browser-api.blockstack.org F471237

Steps to Reproduce:

1. Download https://github.com/blockstack/blockstack-browser/releases/download/v0.36.1/Blockstack-for-macOS-v0.36.1.dmg
2. Install the dmg
3. Fire up a Proxy like BurpSuite
4. Configure your browser to use Burpsuite as it's Proxy and remove the localhost/127.0.0.1 proxy exception so that ALL traffic destined for localhost is also passed through the proxy.
5. launch the blockstack app. Visit http://localhost:8888/sign-up in your browser of choice (I tested with FireFox 66.0.3 64 bit) on Mac OS 10.14.4
6. observe outbound connections to the 3 sites listed above.

To Resolve:

1. Include a Referer-Policy header in BlockStack Browser to not leak the CoreAPIPassword. https://www.owasp.org/index.php/OWASP_Secure_Headers_Project#rp
2. Better to Not pass sensitive data in URL params at all: full URL's are usually logged in plaintext LoadBalancer logs (you can confirm this by checking your Cloudflare or the access logs for browser-api.blockstack.org), Analytics and tracking services and sometimes in other unexpected places.

References:

1. https://www.owasp.org/index.php/Information_exposure_through_query_strings_in_url
2. https://www.owasp.org/index.php/OWASP_Secure_Headers_Project#rp

Impact

• compromise or accidental exposure of any of the sites, loadbalancer logs, or tracking services used on the listed sites would expose BlockStack users' CoreAPIPasswords.
• This leakage of the CoreAPIPassword contradicts public statements by a BlockStack Engineer regarding the CoreAPIPassword (https://forum.blockstack.org/t/seriously-blockstack-core-api-password-is-plaintext-in-api-settings/2272)