cheap satisfaction
Hopelessly navigating through my internship search season, as usual I was applying to internships with my AI autofiller, which autofills and I crosscheck. This was for a very small consulting company (never heard of them), and suddenly I saw a unique text box I’ve never seen in the hundreds of applications I did over the last few months.
This particular application was for an unknown, very, very small services company, the pay was also subpar for nyc standard (on-campus job on columbia pays more than that), so the number of applicant is very very very low, because they had this mandatory paraphrase you needed to figure out, and it wasn’t worth the time.
I skipped it and moved to the next application, but it kept bugging me. I understood there was some decryption involved, but it was too vague.
The vagueness was annoying, so I wanted to give it a shot by asking an LLM.
Step 1 was the obvious one, I gave it to Gemini 4 Argon, because it had just been released and I wanted to check its capability. Funnily, it couldn’t do it. Opus was even worse, because the characters were so random that it flagged the prompt as part of its guardrails, despite me rephrasing it multiple times.
Just looking at the string, it was very long, and there was no indication of a key to decrypt it, the length was extremely long, and I noticed it had capital letters mixed in, which I’d never seen in a SHA-256 or SHA-512 hash. So I figured this probably wasn’t just a raw SHA string, there had to be one more step before getting to whatever the actual key or hash function was. Then I noticed the string only had capital letters, lowercase letters, and an equals sign, and that equals sign at the end was bugging me. looked very similar to something ive seen years ago but I coudnt recollect. I remembered, like six or seven years ago, going through a Stack Overflow thread about a format that uses == at the end for padding. So I wrote a small function to count the characters, it was 64 characters plus an equals sign at the end, and I was pretty sure this was a base64 string. I went and googled like an old caveman, found that exact same old Stack Overflow thread again, and confirmed it was base64, because they pad with = at the end to make the length divisible by 4, which is how base64 decoding works. I’ll link the stack overflow thread here so you can understand how base64 decoding works. I still remember it because, five or six years back, I had to learn base64, and I remember somebody on that thread drawing out a table and explaining step by step how to encode and decode it. So I went back to that table, confirmed it was base64, and decoded it.
echo 'LQpCZWxvdy...Ci0=' | base64 -d
this was the text message which was encoded as base 64:
Below is a sha256 hash of the f"{passphrase}{salt}" to apply. The string "companyname" is the salt.
aac57435fb435............d1dddd6e1
So the next step was, we have the SHA hash, and we have the salt, which is the company name. Basically, what a salt does is, it add randomness, because you take a key that needs to be hashed, concatenate it with the salt (key plus salt), and hashing that combined string gives you even more randomness for the SHA output. But here’s where you need to understand the difference between encryption and hashing. SHA is a hash function, so some data goes into the SHA-256 hash function and comes out as the string above, and you can’t decrypt this, you can’t go back from a hash function, unlike encryption. With encryption, when you encrypt data you can decrypt it back, using either asymmetric or symmetric encryption depending on the style you use. But hashing is a one-way road, once you pass a string through the hash function, it gets hashed, and you can never get back to the original string.
So now I got stuck. Because once you have a hash function and a hashed digest, how do you get back to the original string? The only way is to guess the original string, add the salt, run it through SHA-256, and see if it matches. So it felt like a dead end, because I didn’t know how to proceed. I was wondering if the founder wanted me to do some basic social engineering to figure out what the key might be and then hash it, that was the most obvious thing that came to mind, but I didn’t have the time for that. All I was doing this for was the curiosity of figuring it out, and spending time trying to guess what the key could be felt like a lot of grunt work and not anything technical.
So I did exactly what a monkey would do. Since SHA-256 doesn’t take a lot of time to compute, what if I ran it through a huge corpus of English words and checked if any of them matched this string? Such an idiotic idea, but it seemed viable, because I assumed the corpus wouldn’t be too huge. The second thing was that since no individual word depends on another word, even if it took a lot of time, I could just process it in parallel. I’d read about something similar in my paper reading sessions, MapReduce also has mappers and reducers doing a counting task like this. This is even simpler, since every individual word is its own independent task, there’s just one global string you compare each word’s hash against, and no task depends on another, so you can batch and process it in parallel. I thought this could be a good idea, so I googled around and found a dataset called Infochimps.
The website looked very old, I think it was maintained somewhere between 2011 and 2020. It had a corpus of 350k words, and I found out this is a pretty common dataset that hackers use to crack passwords. I also found this GitHub repo, which had around 450k words, and I figured I’d run that one next if needed. But I got lucky. I opened the Excel file, took the data, and ran through every individual word, adding the salt to it, hashing it, and running that in parallel to check if it matched the actual word. Technically, parallel processing was overkill here, since it’s only 350k words, not a lot. Sadly, I didn’t get a chance to time it, since I was running out of time, but it didn’t take very long. Either way, I ran it in parallel. And there was a word that exactly matched the string, the word was tuna. tuna + company name matched the SHA-256 hash!
The best part about this is the Stack Overflow thread I read about six or seven years ago, and I went back to it because some part of it was still stuck in my mind. That’s something you could never replicate with an LLM, because almost all LLM generated text looks the same. But Stack Overflow has this unique thing where some comment might make you laugh, some comment might make you think, or some explanation might be so good that even six or seven years later, even though I don’t remember the exact algorithm for decoding, I still remember seeing that table and a bunch of detailed explanation. Glad Stack Overflow still exists.
I’m very, very sure that with a powerful LLM and the right prompt, it would’ve decoded this itself, but I just wasn’t good at prompting it this time. Maybe if you prompt it properly, you could skip one or two steps here and let the LLM do that for you, and get through it easily. But I did it myself, and it was fun. The unfortunate thing is I got an immediate rejection email, maybe because of my visa status or something else, I don’t know. But by now I’m used to rejections, since almost 99.9% of all my applications get rejected anyway. So that’s okay, I’ve seen such outcomes before, but this was the first time I tried something like this, and it was fun. ufff, what a relief.