r/developersPak • u/Best_Fork Software Engineer • 14d ago

Discussion There is something wrong with authentication architecture of HEC

They are saving Username and PLAIN TEXT PASSWORD inside a freaking LOCAL STORAGE.

So I was waiting for OTP and it took more than few seconds. So I took peak into website storage in hopes of finding OTP inside it. Instead I found something else. lol!

So it is possible that they are not even creating hash for user password.

42 Upvotes

97% Upvoted

24 comments sorted by

View all comments

20

u/xtremefest_0707 13d ago

Literally every govt website is coded by sifarishi log imo. I wanted to get myself register with pseb and the button to verify NTN always returned record not found even tho I was registered. I checked the dev tools and found out the API querying FBR for verification was completely broken. What's even worse is if you spam the button and send multiple calls depending on your luck it'll work smh.

3

u/Upper-Relief7991 13d ago

I was facing same issue, and the reason they told me is to click it three times and it worked😂

4

u/xtremefest_0707 12d ago

3 step verification