From experience, this is incredibly hard (bordering on impossible) to do without enabling enumeration attacks
But, perhaps they've pulled off something magical here?
*enumeration attacks meaning you can plug in 100,000 phone numbers and get back a list of matching usernames
add a skeleton here at some point
7 months ago