News for hackers. Stuff that matters.

A comment on Robinhood Stored Passwords in Plaintext. Parent comment

Re:Robinhood Stored Passwords in Plaintext by MrStonedOne on Thursday July 25, 2019 @06:44AM (#20524250)
You would want to use a token and the string and only accept the token to look up the string that you would only accept once and for a limited time.

Otherwise its vulnerable to replay attacks

[ Parent | on HN ]
Re:Robinhood Stored Passwords in Plaintext by ifdefdebug on Thursday July 25, 2019 @10:02AM (#20525410)
Yes I think I was cashing the generated string server side for a while and checking if the string I received back had a matching entry in the cache, otherwise reject it.

Anyway, it's been a long time ago, and if I had to do it again today, i would rather not roll my own.

[ Parent | on HN ]