News for hackers. Stuff that matters.

A comment on Lenovo Forums stores plaintext password as a cookie.

Re:Lenovo Forums stores plaintext password as a cookie by 37 on Friday April 22, 2022 @09:27AM (#31121294)
From Jan 31.... Wonder if this has been fixed yet
[ Parent | on HN ]
Re:Lenovo Forums stores plaintext password as a cookie by iamdual on Friday April 22, 2022 @09:50AM (#31121488)
Yeah, tested. They fixed.
[ Parent | on HN ]
Re:Lenovo Forums stores plaintext password as a cookie by aendruk on Friday April 22, 2022 @10:54AM (#31122318)
Did you select “Remember me” in your test?
[ Parent | on HN ]
Re:Lenovo Forums stores plaintext password as a cookie by iamdual on Friday April 22, 2022 @07:20PM (#31129466)
Yes, I found a remember me button on an external login page. There was a base64 encoded cookie but not in plain text. It was JSON string, includes some AES like encryption data, and expiry time.
[ Parent | on HN ]