We'll Pwn You With Your Wattpad Profile

The talk starts from the attacker's side of a data breach. Leaked databases often hold password hashes rather than plaintext, but a cracker can run large lists of candidate guesses through the same algorithm offline and compare the results against the leak. The speaker walks through how this works, moving from brute force to dictionary wordlists, combined words, common character substitutions, and phrase-based tricks that turn a memorable sentence into a short string of initial letters.

The middle of the talk covers a student research project. The team fine-tuned GPT-3 on about 10,000 examples drawn from a 2018 Wattpad breach, pairing profile fields such as usernames and bios with the passwords tied to them. Given a target's public details, the model produced guesses that outperformed a list of common passwords within a small number of attempts, and the speaker reported roughly three times the accuracy of non-targeted guessing. The work was small and the speaker described its limits openly. The question round covered entropy thresholds, comparison with other targeted guessing tools, and the ethics of the study.

The closing section turns to defense. Long, unique passwords, password managers such as Bitwarden or KeePassXC, and Diceware-style passphrases for critical accounts reduce exposure. The speaker suggests estimating entropy against a realistic threat model, so that memorable passphrases still hold up against guessing.