From the paper: > Signal acknowledged the issue of enumeration attacks as not fully preventable, So rate-limiting is fine as long as you don't hurt user

From the paper: > Signal acknowledged the issue of enumeration attacks as not fully preventable, So rate-limiting is fine as long as you don't hurt user experience, e.g. you can still message your contacts within 1min if you have around 500 contacts. It's also nice to lower the load on the servers. But there's no real fix as long as phone numbers are used. And it's fine, given that Signal basically leaks one bit of information: whether a phone number has a Signal account or not. ...of course, assuming that the account owner doesn't accept unsolicited messages (and thus shares their profile, with their picture and "About" field).