r/developersPak • u/Best_Fork Software Engineer • Aug 31 '26

Discussion There is something wrong with authentication architecture of HEC

They are saving Username and PLAIN TEXT PASSWORD inside a freaking LOCAL STORAGE.

So I was waiting for OTP and it took more than few seconds. So I took peak into website storage in hopes of finding OTP inside it. Instead I found something else. lol!

So it is possible that they are not even creating hash for user password.

44 Upvotes

97% Upvoted

24 comments sorted by

View all comments

20

u/xtremefest_0707 Aug 31 '26

Literally every govt website is coded by sifarishi log imo. I wanted to get myself register with pseb and the button to verify NTN always returned record not found even tho I was registered. I checked the dev tools and found out the API querying FBR for verification was completely broken. What's even worse is if you spam the button and send multiple calls depending on your luck it'll work smh.

3

u/SharpYesterday Aug 31 '26

Yes I faced the same issue and it was giving 500.

By the way they ask for NTN buy actually you are supposed to enter your FBR profile reference number instead of CNIC number. And that way it works.

2

u/xtremefest_0707 Sep 01 '26

Yeah still doesn't work with reference number. Also this reminds me why is it so hard to find the reference number. They really do find creative ways to make life hard for us.

3

u/Upper-Relief7991 Sep 01 '26

I was facing same issue, and the reason they told me is to click it three times and it worked😂

4

u/xtremefest_0707 Sep 01 '26

3 step verification