3 ms·
Username enumeration is useful against a system with 10 or 1000 accounts, but absolutely meaningless on a system with 1,000,000,000 regular users.
by angry_octet 10y ago
Username enumeration is useful against a system with 10 or 1000 accounts, but absolutely meaningless on a system with 1,000,000,000 regular users.
- blincoln 10y agoIt can be useful in either case. It depends on what the attacker is trying to achieve. If they just want to get in as any user, then your hypothetical system with a billion regular users is going to be even easier, because if even a fraction of those can be enumerated, it's likely that at least some will be accessible using a password-spraying attack using one or two common passwords, or by cross-referencing with passwords disclosed in a breach.
- fixermark 10y agoBut if we're talking concretely about GMail here, the easiest way for someone to get in as "any user" is to create a GMail account.