I think the details were pretty interesting, so let me expand your summary:
1. Someone gets permission to hack their friend
2. They find their email / phone number online
3. They lookup old password leaks for the email
3.1. They find their password hash (salted) in the Tumblr dump
3.2. Tumblr turned out to use the same hash for everybody, so the author
finds other accounts with the same hash, follows them to a LinkedIn
leak (unsalted), and successfully recovers the password
3.3. The password turns out not to work (changed some time ago)
4. They end up setting up a fake page to phish their friend
4.1. First phishing attempt produces... the old password that is already
known through point 3.
4.2. Second attempt is modified to reject user input a few times, producing
another password, which happens to work
4.3. The victim grows suspicious of the phishing e-mails, but another
message puts those suspicions to rest
5. They wait until their friend falls asleep to reset the Twitter password and (later, in the same way) capture
their LinkedIn account
6. They photoshop their profile pictures to subtly include a Mario character, and they
make their friend follow a bunch of fake Mario accounts on Twitter
6.1. When that doesn't get noticed, they redo the trick in a much less subtle way
7. Friend notices, they meetup to swap stories (the friend doesn't follow the fake Mario accounts)
I really couldn't stand the writing style the author used — I understand peppering your writing with jokes, but there were far too many attempts at 'humour' for my taste.
I actually found it pretty easy to skim the article by simply ignoring the jokes. It was about 3 joke sentences to 1 relevant sentence and fortunately he was reasonably consistent in his unconventional sentence formation in his joke writing, making it really easy to skip them.
You're assuming they actually read the threads. It would be easier, and yield the same results, to merely read the headline, and write based on that. In fact, I'm sure a simple script could cover the majority of cases, leaving them to only need to write for the odd one their script can't cover.
There was a community-driven project for exactly this. It was hosted on http://tldr.io. There was a browser extension showing you the summary of an article when you visited it and you could contribute your own summaries. And I started creating a Windows Store app (back in the time of Windows 8.0) for browsing all TL;DRs.
But sadly, the project has been discontinued for a couple of years already. I think it lacked incentives for summary writers (for example micro payments from summary readers) and also a monetarization model for the project creators.
3.2 Tumblr used same salt for everybody, but author don't know the salt. He searched the hashed password and found 20 other users have same password hash, using same password.
3.3 Linkedin leak have no salt, by looking for the 20 other users he found the plain text password, which should be the target password.
