3 ms·
Hey zabana, it looks like one of your endpoints is leaking password hashes that might be undesired? POST https://cognito-idp.us-east-1.amazonaws.com/ https://
by jzig 3y ago
Hey zabana, it looks like one of your endpoints is leaking password hashes that might be undesired?
POST https://cognito-idp.us-east-1.amazonaws.com/ https://cognito-idp.us-east-1.amazonaws.com/
Response:
```
{
"ChallengeName": "PASSWORD_VERIFIER",
"ChallengeParameters": {
"SALT": "*",
"SECRET_BLOCK": "*",
"USER_ID_FOR_SRP": "*",
"USERNAME": "*",
"SRP_B": "**"
}
}
```
- zabana 3y agoOh ! Will investigate and fix ASAP. Thanks for the help !
- throwoutway 3y agoSRP (Secure Remote Password) does not store password in hashes, but rather uses a zero knowledge proof https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco... Without making the same post call, I thinnk you are seeing the challenge codes for the proofing