Quote:
Originally Posted by k0nr4d
They store it in an md5 hash, you can see it in the cookie named 'toplabs' that they store when you login:
a:3:{s:4:"user";s:25:" [email protected]";s:4:"pass";s :44:"passwordhashhere";s:2:"no";i:13;}
What they store in the cookie is what appears to be a base64-encoded md5 hash. It appears to be salted. |
MD5 has been ripped to pieces a long time ago. As a financial institution they should be using bcrypt minimum.