Update 04:49 UTC: I am done reverse-engineering Pandora's javascript code!
And I was right: the JSON object that it stores in the HTML local storage is merely obfuscated with static keys, not encrypted. I was able to decrypt the full object, including my Pandora password:
lastUserId: "xxxxxxxxx"
storedUserIds: ["xxxxxxxxx"]
Uxxxxxxxxx.StationSortOrderAlpha: false
Uxxxxxxxxx.isAnonymous: false
Uxxxxxxxxx.Username: "xxx@xxx.com"
Uxxxxxxxxx.Password: "myCleartextPassword"
hasLoggedIn: true
(xxxxxxxxx) is the numeric Pandora user ID.
I will publish an tool for decryption as a proof-of-concept, in the next hour.
What were Pandora's developers thinking? This is not a huge flaw, but they should certainly not store sensitive data like the user's password in the local storage.
Yup, I tested with 2 different accounts, using 2 different browsers, even from 2 different IPs. The static keys seem to never change, they are served from the same .js file.
And I was right: the JSON object that it stores in the HTML local storage is merely obfuscated with static keys, not encrypted. I was able to decrypt the full object, including my Pandora password:
I will publish an tool for decryption as a proof-of-concept, in the next hour.What were Pandora's developers thinking? This is not a huge flaw, but they should certainly not store sensitive data like the user's password in the local storage.