2 ms·
Update 04:49 UTC: I am done reverse-engineering Pandora's javascript code! And I was right: the JSON object that it stores in the HTML local storage is merely
by mrb 14y ago
Update 04:49 UTC: I am done reverse-engineering Pandora's javascript code!
And I was right: the JSON object that it stores in the HTML local storage is merely obfuscated with static keys, not encrypted. I was able to decrypt the full object, including my Pandora password:
lastUserId: "xxxxxxxxx"
storedUserIds: ["xxxxxxxxx"]
Uxxxxxxxxx.StationSortOrderAlpha: false
Uxxxxxxxxx.isAnonymous: false
Uxxxxxxxxx.Username: "xxx@xxx.com"
Uxxxxxxxxx.Password: "myCleartextPassword"
hasLoggedIn: true
(xxxxxxxxx) is the numeric Pandora user ID.
I will publish an tool for decryption as a proof-of-concept, in the next hour.
What were Pandora's developers thinking? This is not a huge flaw, but they should certainly not store sensitive data like the user's password in the local storage.
- cbsmith 14y ago> Update 04:49 UTC: I am done reverse-engineering Pandora's javascript code! Good job! > This is not a huge flaw, but they should certainly not store sensitive data like the user's password in the local storage. Well, if it was properly encrypted, I'd disagree with you, but since it isn't, I'm not going to quibble. Out of curiosity, how do you know the key is static, and not per account? Did you test with two accounts?
- mrb 14y agoYup, I tested with 2 different accounts, using 2 different browsers, even from 2 different IPs. The static keys seem to never change, they are served from the same .js file.
- mrb 14y agoDone: Pandorhack: Stealing Pandora Passwords http://news.ycombinator.com/item?id=4553184 http://news.ycombinator.com/item?id=4553184
- flyinRyan 14y agoVery well done.