yeah might need first + last, even then it could still be brute forced eventually… so single users could be cracked if someone was motivated enough