Say that I have a website that allows for a user to reset his password through either email or via text message. The user should be allowed to choose one or the other.
Without giving away too much information, what would be the optimal amount of characters to display for a phone number and for an email address to allow the user to reset their password?
Most sites that I've come across don't display emails at all (knowing only a few characters could help an attacker link an email to an account), and just send a reset email silently. But phone numbers seem to be treated differently, as sites tend to display at least part of phone numbers, often using the last two characters of the number like so:
Is this the best convention to follow in terms of balancing usability and security? Why do websites display any part of a phone number when they don't display emails, and is there any associated risk with displaying that the user has a phone and/or email connected to their account in the first place?