Improve Repl Identity

Support Feature Requests
1

Describe your feature request
Please improve repl identity, I was discussing with the @InvisibleOne here, and we found you can merely do ctrl + c, ctrl + d, and create a new token. This is true because the env var where the token is stored is recent after doing ctrl + d even if you deleted it via try/finally in your repl. Therefore, anyone and everyone can merely generate a new token, even one that has an origin id = the correct verified one

What problem(s) would this feature solve?
This would solve the fact that repl identity is supposed protect applications, however, using this technique seems to bypass everything

Explain what you were trying to do when you came across the problem leading to this feature request
I was attempting to add anti-hacks to Arrowfall, but was talking to InvisibleOne, and were discussed that this could work

1 Like
2

Have you actually tried this

4 Likes
3

Um, I did not, it was invisible one who was telling me about it. I apologize it my information was incorrect

EDIT: AFTER TESTING, YES I CAN CONFIRM THAT YOU CAN DO THIS

EDIT 2: I’ve had MNA4 test it as well and it seems they have also been able to bypass it, but I haven’t gotten exact correspondence as to how, but I suspect this is how they did it

1 Like
4

Tell them to set a score of 249wpm on this repl: https://replit.com/@CodingCactus/CodingCactuss-Typing-Test?v=1

2 Likes
5

I’m sorry I don’t know ruby well enough XD

6

Question, if I were to do this I would need to know, are you using replit cli with command?
/nix/store/qbhmp77djj7ng86nnbk9czsjibzvw2n7-replit-cli-0.1.0/bin/replit identity create -audience={audience_id}

7

It’s just a standard repl identity setup, all you need to know is http requests, POST the following as form data to https://typing-test-server.codingcactus.repl.co/new-test-result/100

{
    "token": "your somehow generated valid token",
    "net_wpm": 249,
    "gross_wpm": 249,
    "accuracy": 1
}
2 Likes
8

I’m sorry lol, I don’t know for sure, but it would suck if it doesn’t work on your server but I can verify without a shadow of a doubt that it works on mine XD

9

Yes that is what I am doing

2 Likes
11

oops, nvm it totally work
image
image

12

:open_mouth: you should probably contact replit team, because you’ve basically broken their product, nice work :stuck_out_tongue_winking_eye:

3 Likes
13

thanks :smiley: I used this code

from os import environ as env
from json import loads
import subprocess
import dataclasses
from urllib import request, parse

REPLIT_CLI = env["REPLIT_CLI"]
def create_identity_token(audience: str, cmd: str = "replit") -> str:
     """Create an identity token addressed to the given audience."""
     token = subprocess.check_output([cmd, "identity", "create", f"-audience={audience}"])
     return token.decode("utf-8").strip()

data = parse.urlencode({"token": create_identity_token("4cfd0819-8d8a-49bb-9518-6d20e66d53f9", REPLIT_CLI), "gross_wpm": 249, "net_wpm": 249, "accuracy": 1}).encode()
req = request.Request("https://typing-test-server.codingcactus.repl.co/new-test-result/100", data=data)
resp = request.urlopen(req)

sorry to bother you!

1 Like
14

How did you change the replid to be the fake one

2 Likes
15

? Sorry I don’t understand what the replid means, I just copy pasted your in code repl id, if you mean I changed the output replid it’s because I generated the code INSIDE your code by pressing ctrl c, ctrl d and therefore the token generated in the env repls is going to be one for that repl id.

Also, I couldn’t find the replit discord, could you give it to me XD

3 Likes
16

Ah right you did it inside my repl, I get it

3 Likes
17

yeah that was the problem I was outlining in it as I discussed it with InvisibleOne

2 Likes
18

Pretty sure it’s just https://replit.com/discord

3 Likes
19

I get 404 errors, and I can’t even find it on the sidebar links anymore :frowning:

1 Like
20

Maybe Replit

3 Likes
21

thanks! That works, sorry to bother you!

2 Likes