I’m wondering if leaving the URLs in plaintext was actually a good idea, here’s my reasoning: With _random_ passwords which most LastPass users probably genera

I’m wondering if leaving the URLs in plaintext was actually a good idea, here’s my reasoning: With _random_ passwords which most LastPass users probably generated, the attacker has no way of knowing if a key resulted in a successful decryption unless they login to a particular site. If the URLs were part of the encrypted payload though, a quick string check for “http” or “www” would tell them if a key was correct or not during their brute-force attempts. Maybe a silver lining?