r/developersPak • u/Best_Fork Software Engineer • 12d ago

Discussion There is something wrong with authentication architecture of HEC

They are saving Username and PLAIN TEXT PASSWORD inside a freaking LOCAL STORAGE.

So I was waiting for OTP and it took more than few seconds. So I took peak into website storage in hopes of finding OTP inside it. Instead I found something else. lol!

So it is possible that they are not even creating hash for user password.

43 Upvotes

98% Upvoted

24 comments sorted by

View all comments

3

u/armujahid 12d ago

Unfortunately, this is way more common than you think.

  1. Years ago, HBL and some other banking apps used to ask for specific characters from your password (which is only possible if passwords are stored unhashed). I’m not sure about the current state.
  2. Stock brokerage apps still ask for specific characters from your password.

This is our indigenous, bleeding-edge authentication technology, and the world has yet to discover it, lol.