That time I used Ruby to crack my Reddit password

on YouTube ↗27m

" summary

Locks a throwaway Reddit password into LetterMeLater then scrapes its search box behavior and builds a Ruby tool called lettermenow.rb using the Faraday gem and a captured cookie to query the site. Exploits a substring oracle: find a character not in the subject, extend forward and backward to recover the full 22‑char secret. The script runs 403 queries against the site (predicted ~432) and successfully retrieves the lost password.

AI-written summary · about

" chapters (19)

1. 0:00Intro
2. 0:38Addiction to useless websites
3. 0:54No selfcontrol
4. 1:19Odysseus
5. 1:34What I did
6. 4:13Two years later
7. 4:43Logging back in
8. 5:43Searching for the password
9. 6:55substring queries
10. 7:35the algorithm
11. 10:21thats doable
12. 10:53building the API
13. 15:04building the algorithm
14. 17:17finding the first letter
15. 18:33bill forward
16. 19:54build backward
17. 22:32build forward false
18. 24:29build backwards
19. 25:12conclusion

" related talks

• 42mHacking With GemsBen Smith · RubyConf AU 2013
• 25m80,000 Plaintext Passwords: An Open Source Love Story in Three ActsT.J. Schuck · Cascadia Ruby 2014
• 34m80,00 Plaintext PasswordsT.J. Schuck · Rocky Mountain Ruby 2014
• 40mFantastic Passwords and Where to Find ThemPhil Nash · NoRuKo 2020
• 31m680,000 Plaintext Passwords: An Open Source Love Story in Three ActsT.J. Schuck Fluffmuffin · ArrrrCamp 2014
• 31mHacking with GemsBen Smith · Aloha RubyConf 2012
• 59mHack Yourself FirstTroy Hunt · Web Directions South 2013
• 29m80,000 Plaintext Passwords: An Open Source Love Story in 3 ActsT.J. Schuck · Red Dot Ruby Conference 2014