First Flight #1: PasswordStore

Summary

Thinking from the perspective of Web2 security, further conditional judgment should be made about the setting of Password. For example, the length of Password should not be less than 8 bits, Password should not be a weak password (e.g. 123456), and Password should not be just a simple number.

Impact

An overly simple password can be easily brute-force broken.

Tools Used

Manual Review

Recommendations

1. s_password should meet a certain complexity, such as using a password with a length of more than 8 digits, containing letters, numbers, and special symbols.

2. Further encryption is performed on s_password.