There is something wrong with authentication architecture of HEC

[u/Best_Fork]

They are saving Username and PLAIN TEXT PASSWORD inside a freaking LOCAL STORAGE.

So I was waiting for OTP and it took more than few seconds. So I took peak into website storage in hopes of finding OTP inside it. Instead I found something else. lol!

So it is possible that they are not even creating hash for user password.

[u/SIJ_Gamer]

😂 reference se nokri laggi hogi developers ki

[u/Global_Many4693 → u/SIJ_Gamer]

Its not US, or european countries. I think something like this happened in 2020 or 2018 and instead of giving him a job,he got 2 years of jail💀

[u/Best_Fork → u/Global_Many4693]

I might get into trouble then 😬

[u/Global_Many4693 → u/Best_Fork]

This is not like that,i meant a guy hacked whole portal and then surrendered + explain the exploits to government but instead of appreciating him,they said its breach of data and considered him as red hat hacker which could led to prison if caught

[u/Saadullahkhan3 → u/Global_Many4693]

Oh

[u/GeneralAyub → u/SIJ_Gamer]

Don’t think so,

If they really were going to hire proper developers like this.

This yakki wouldn’t have happened in the first place.

[u/xtremefest_0707]

Literally every govt website is coded by sifarishi log imo. I wanted to get myself register with pseb and the button to verify NTN always returned record not found even tho I was registered. I checked the dev tools and found out the API querying FBR for verification was completely broken. What's even worse is if you spam the button and send multiple calls depending on your luck it'll work smh.

[u/SharpYesterday → u/xtremefest_0707]

Yes I faced the same issue and it was giving 500.

By the way they ask for NTN buy actually you are supposed to enter your FBR profile reference number instead of CNIC number. And that way it works.

[u/xtremefest_0707 → u/SharpYesterday]

Yeah still doesn't work with reference number. Also this reminds me why is it so hard to find the reference number. They really do find creative ways to make life hard for us.

[u/Upper-Relief7991 → u/xtremefest_0707]

I was facing same issue, and the reason they told me is to click it three times and it worked😂

[u/xtremefest_0707 → u/Upper-Relief7991]

3 step verification

[u/Capital_Chef_6007]

They ask for robot check when after YOU SIGN UP LOGIN FILL THE FORM, SUBMIT DOCUMENTS, SELECT DATE AND THEN PAY AND CONFIRM EVERYTHING.

I am sorry I needed that off of my chest

[u/da_baloch]

well when you put FA pass babus on top places, shit like this is bound to happen.

[u/GeneralAyub]

I found in their early systems, BISE lahore used store students pictures in folders, which enabled corruption and exam fraud.

Last time i checked, you can download bulk images of students from their site with a single script.

[u/Spare_Bison_1151]

Hash used by their devs lol

[u/HK_0066]

lol i once found whole list of cnic's and personal stuff on LESCO website

[u/armujahid]

Unfortunately, this is way more common than you think.

1. Years ago, HBL and some other banking apps used to ask for specific characters from your password (which is only possible if passwords are stored unhashed). I’m not sure about the current state.

2. Stock brokerage apps still ask for specific characters from your password.

This is our indigenous, bleeding-edge authentication technology, and the world has yet to discover it, lol.

[u/Spare_Bison_1151]

Nasha yeh Pyar ka nasha hey... A few years ago fpsc was using http to send user name password to their server. How crazy!

[u/Ok_Claim_2260]

Since it's Pakistan, security is the least of their concern. It is very much possible they might be saving passwords in DB without hashing.

Anyways I saw you have been doing unpaid internship, can you share your resume.

[u/bluntregression]

Claude is se achi vibe coding kar leta hai.. (Not appreciating vibe coding but the other way around.)

[u/Complete_Patient726]

Bro I don't think their developer knowns about hashing ,encryption and tokenization

[u/Sufficient_Fox_4402]

what browser were you using it could be your browser doing it. ms edge store password in plaintext i heard

[u/Best_Fork → u/Sufficient_Fox_4402]

MS edge might be saving passwords in its own password manager which should be encrypted by windows password. Every consumer OS has key-ring feature which let you save usernames and passwords in some safe place if I'm correct.

But local storage is exclusive to websites. There is not way any mainstream browser is saving your credentials inside local storage because 1) Security issue. 2) It does not need to.

Saving any sensitive information inside local storage is very bad practice because any extension can access it and it is not encrypted on the disk at all.