That being said, it was pretty clever to take advantage of an enumeration attack on another service that wasn't protecting against enumeration attacks on the feature because frankly, why would they?
No. I went in expecting it to be about a guy who lost his own password to Reddit and had to crack it.
Spoiler: That's what the article was about.
This article, while interesting, is really just about general password cracking.
"Is there an F in your password? Yes, you have one F, now guess again..."
But to get on topic: This was one of my favorite ways of recovering passwords when I had a blind SQL injection somewhere. I wrote a nice perl script that brute forced (yes the guy in the article also brute forced) the field through the SQL substr command. Happy, simpler times :)
The article is a subversive ad for http://lettermelater.com and little more.
It turns out (due to repeated chars) to only have 14 unique chars. This single run through would have reduced the alphabet size (A, in the article) from 36 to 14. The 432 iterations becomes 168.
I'm sure there are other optimisations I'm missing!
https://news.ycombinator.com/item?id=14108223 (17 days)
https://news.ycombinator.com/item?id=14076918 (20 days)
https://news.ycombinator.com/item?id=14071188 (21 days)
https://news.ycombinator.com/item?id=14054289 (23 days)
https://news.ycombinator.com/item?id=14051671 (24 days)
None have any comments, very few upvotes, so maybe it's worth another chance. Personally, I found it unreadable. I'm sure others will find it fascinating and be able to get past the IN YOUR FACE style and flashing graphics.
Oh, and FWIW, I didn't downvote you.
