News for hackers. Stuff that matters.

A comment on Robinhood Stored Passwords in Plaintext. Parent comment

Re:Robinhood Stored Passwords in Plaintext by ifdefdebug on Thursday July 25, 2019 @05:30AM (#20523915)
I used this when I was doing web apps for small enterprises in early 2000's - I sent a random string in a hidden input in the login form and had some javascript concatenate the password and the random string and send me back the username, the random string and the hash of the concatenated string. I hope I got that right (not doing web apps any more since a long time ...).
[ Parent | on HN ]
Re:Robinhood Stored Passwords in Plaintext by MrStonedOne on Thursday July 25, 2019 @06:44AM (#20524250)
You would want to use a token and the string and only accept the token to look up the string that you would only accept once and for a limited time.

Otherwise its vulnerable to replay attacks

[ Parent | on HN ]
Re:Robinhood Stored Passwords in Plaintext by ifdefdebug on Thursday July 25, 2019 @10:02AM (#20525410)
Yes I think I was cashing the generated string server side for a while and checking if the string I received back had a matching entry in the cache, otherwise reject it.

Anyway, it's been a long time ago, and if I had to do it again today, i would rather not roll my own.

[ Parent | on HN ]