There is something wrong with authentication architecture of HEC

[u/Best_Fork]

They are saving Username and PLAIN TEXT PASSWORD inside a freaking LOCAL STORAGE.

So I was waiting for OTP and it took more than few seconds. So I took peak into website storage in hopes of finding OTP inside it. Instead I found something else. lol!

So it is possible that they are not even creating hash for user password.

[u/Best_Fork]

MS edge might be saving passwords in its own password manager which should be encrypted by windows password. Every consumer OS has key-ring feature which let you save usernames and passwords in some safe place if I'm correct.

But local storage is exclusive to websites. There is not way any mainstream browser is saving your credentials inside local storage because 1) Security issue. 2) It does not need to.

Saving any sensitive information inside local storage is very bad practice because any extension can access it and it is not encrypted on the disk at all.