Live data from Hacker News

Show HN: Ngnr.club – A link-in-bio service for engineers

ngnr.club

41–46 of 46 posts

Re: Show HN: Ngnr.club – A link-in-bio service for engineers

#42
post #41

$ User already exists ... $ Cognito received the following error from Amazon SES when attempting to send email: Email address is not verified. The following identities failed the check in region US-EAST-1:

I've just confirmed your account (@dylan)

Thanks for your patience !

Re: Show HN: Ngnr.club – A link-in-bio service for engineers

#43
post #31

Hey zabana, it looks like one of your endpoints is leaking password hashes that might be undesired? POST https://cognito-idp.us-east-1.amazonaws.com/ Response: ``` { "ChallengeName": "PASSWORD_VERIFIER", "ChallengeParameters": { "SALT": "* ", "SECRET_BLOCK": "* ", "USER_ID_FOR_SRP": "* ", "USERNAME": "* ", "SRP_B": "**" } } ```

SRP (Secure Remote Password) does not store password in hashes, but rather uses a zero knowledge proof https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco... Without making the same post call, I thinnk you are seeing the challenge codes for the proofing

It still contains SALT and SECRET_BLOCK?
Post reply on HN