from Hacker News

Cracking My Own Reddit Password

by chjohasbrouck on 4/30/17, 5:44 PM with 17 comments

  • by jedberg on 4/30/17, 6:37 PM

    Clickbait title much? This basically has nothing at all to do with reddit. You could replace the word reddit with Facebook in this article and it would be exactly the same.

    That being said, it was pretty clever to take advantage of an enumeration attack on another service that wasn't protecting against enumeration attacks on the feature because frankly, why would they?

  • by Retr0spectrum on 4/30/17, 6:12 PM

    This sort of challenge comes up in CTFs quite often. Here's a writeup of one from PicoCTF 2017 (not mine): https://github.com/Caesurus/PicoCTF2017/tree/master/l3_noeye...

  • by stu-harvey on 4/30/17, 6:43 PM

  • by hiisukun on 5/1/17, 2:13 AM

    Perhaps because I'm new to this stuff, I enjoyed the writeup. I wonder if I'm out of place expecting a single run through of a-z 0-9 to determine the range of chars present in the password?

    It turns out (due to repeated chars) to only have 14 unique chars. This single run through would have reduced the alphabet size (A, in the article) from 36 to 14. The 432 iterations becomes 168.

    I'm sure there are other optimisations I'm missing!

  • by rocqua on 4/30/17, 7:05 PM

    It seems like an interesting complication here comes from the subject line. I idly wonder how to handle the case where the subject line had been much larger and had much overlap with the password.

  • by kordless on 4/30/17, 6:15 PM

    Considering how much effort this took, I'm wondering if learning to be more patient might also be an option?

  • by snek on 4/30/17, 6:10 PM

    mfw already posted like two weeks ago

  • by m0atz on 4/30/17, 6:57 PM

    This literally is fucking awesome.