Leaking the phone number of any Google user

“Using a $0.30/hour server with consumer-grade specs (16 vcpu), I’m able to achieve ~40k checks per second.”

A forgotten no-JavaScript recovery form let anyone brute force any Google user’s phone number. A US number took 20 minutes on a 30-cent-an-hour server. Google first called exploitation unlikely and paid $1,337, then raised it to $5,000 on appeal. A phone number is the key to SIM swaps and account takeovers, and Google priced it like a typo.