We consider three attackers:
- A malicious third party trying to discover the identity server mappings in the homeserver.
The malicious third party scenario can only be protected against by rate limiting lookups, given otherwise it looks identical to legitimate traffic.
- An attacker who has stolen an IS db
In theory the 3PIDs could be stored hashed with a static salt to protect a stolen DB. This has been descoped from this MSC, and is largely an orthogonal problem. XXX: is this the right thing to have done?
- A compromised or malicious identity server, who may be trying to determine the contents of a user's addressbook (including non-Matrix users)