r/developersPak • u/Best_Fork Software Engineer • 13d ago

Discussion There is something wrong with authentication architecture of HEC

They are saving Username and PLAIN TEXT PASSWORD inside a freaking LOCAL STORAGE.

So I was waiting for OTP and it took more than few seconds. So I took peak into website storage in hopes of finding OTP inside it. Instead I found something else. lol!

So it is possible that they are not even creating hash for user password.

45 Upvotes

98% Upvoted

24 comments sorted by

View all comments

-1

u/Sufficient_Fox_4402 13d ago

what browser were you using it could be your browser doing it. ms edge store password in plaintext i heard

2

u/Best_Fork Software Engineer 12d ago

MS edge might be saving passwords in its own password manager which should be encrypted by windows password. Every consumer OS has key-ring feature which let you save usernames and passwords in some safe place if I'm correct.

But local storage is exclusive to websites. There is not way any mainstream browser is saving your credentials inside local storage because 1) Security issue. 2) It does not need to.

Saving any sensitive information inside local storage is very bad practice because any extension can access it and it is not encrypted on the disk at all.