- The username recovery form on Google still works without JavaScript, using two HTTP requests to check if a recovery email or phone number is associated with a display name.
- Brute-forcing phone numbers is possible by using IPv6 address rotation to bypass rate limits, but datacenter IPs still face captchas due to JS disabled form restrictions.
- Using BotGuard tokens from the JS-enabled form with the No-JS form bypasses request limits, allowing efficient brute-forcing of phone numbers.
- Google's display name leak via Looker Studio enables attackers to get the victim's name without interaction.
- The full attack chain involves leaking the display name, obtaining the masked phone from the forgot password flow, and brute-forcing the phone number with optimized tools.
- Brute-forcing times vary by country: 20 minutes for the US, 4 minutes for UK, 15 seconds for Netherlands, and 5 seconds for Singapore, with potential reduction using hints from other services.