3 ms·
Yep, my point was that if the phone/email thing is entirely optional, then users can choose not to link any non-random identifier at all. You are right that e-
by dbrgn 6y ago
Yep, my point was that if the phone/email thing is entirely optional, then users can choose not to link any non-random identifier at all.
You are right that e-mail space is also quite small (albeit not as small as phone numbers), especially considering that a huge part of users will have a @gmail.com address.
- bigiain 6y agoIf you attack email addresses as a dictionary attack instead of brute forcing the entire possible email address space, they’re actually a smaller search space. The paper claims 53 trillion possible (global) phone numbers, and 700 billion mobile numbers. Haveibeenpwned has just recently passed 10 billion email addresses- Troy probably doesn’t have _every_ valid email in existence (yet), but I’d be surprised if it was as low as 1 in 70 (or 1 in 5,300). At least cutting phone numbers down to just a specific country works better in eliminating in needed searches than for email (all those @gmail.com @outlook.com and to a lesser extent @company.com addresses aren’t country specific).