4 ms·
That's a valid argument if your threat model only involves other visitors who aren't given access to see email addresses, but it breaks down if you're hiding fr
by hunter2_ 4y ago
That's a valid argument if your threat model only involves other visitors who aren't given access to see email addresses, but it breaks down if you're hiding from the site administrators, an attacker who obtains admin access, and whomever the attacker makes the data available to.