Secure enough for what? The attack is simple: pick a target whose email you know, and then start guessing emails of people you think they might have an accoun

Secure enough for what? The attack is simple: pick a target whose email you know, and then start guessing emails of people you think they might have an account with. This could be as easy as browsing to a website and entering pairs of emails addresses listed on the "About Us" page, or ripping through a person's Facebook friends or Twitter followers. It might be fine for completely non-sensitive data, but for anything else, probably not.