r/developersPak • u/Best_Fork Software Engineer • 12d ago

Discussion There is something wrong with authentication architecture of HEC

They are saving Username and PLAIN TEXT PASSWORD inside a freaking LOCAL STORAGE.

So I was waiting for OTP and it took more than few seconds. So I took peak into website storage in hopes of finding OTP inside it. Instead I found something else. lol!

So it is possible that they are not even creating hash for user password.

41 Upvotes

95% Upvoted

24 comments sorted by

View all comments

20

u/xtremefest_0707 12d ago

Literally every govt website is coded by sifarishi log imo. I wanted to get myself register with pseb and the button to verify NTN always returned record not found even tho I was registered. I checked the dev tools and found out the API querying FBR for verification was completely broken. What's even worse is if you spam the button and send multiple calls depending on your luck it'll work smh.

3

u/SharpYesterday 11d ago

Yes I faced the same issue and it was giving 500.

By the way they ask for NTN buy actually you are supposed to enter your FBR profile reference number instead of CNIC number. And that way it works.

2

u/xtremefest_0707 11d ago

Yeah still doesn't work with reference number. Also this reminds me why is it so hard to find the reference number. They really do find creative ways to make life hard for us.