> website operator can immediately search Facebook for the user name I’m not seeing that. If Facebook recognizes the phone number, it offers to send an SMS to

> website operator can immediately search Facebook for the user name I’m not seeing that. If Facebook recognizes the phone number, it offers to send an SMS to that number or to send an email to an obfuscated email address (like r***@***). At most, you learn that the user’s email starts with an “r” as in example above. And possibly the numbers of letters in the username, but my experiments indicate that Facebook is not telling you the precise number of asterisks to deduce the length. Maybe when you tried it, you were using a known device (eg., having an IP address from which you logged into Facebook on an earlier occasion), and therefore Facebook was offering you more detail, such as your username. Could you try a random phone number from the 533M leaked numbers and see if you still get the username?