@cwebber

Shouldn't this be 20 bytes? There are 32 characters, and each character is base32, or 5 bits. So 160 bits? Edit: nope, wrong.

I don't *think* there's a huge concern over this, because while maybe you could do a birthday collision attack in 80 bits, this wouldn't really get you much and wouldn't let you take over someone else's account. For that you'd need a pre-image attack on the whole 160 bits.

Edit: 120 bits pre-image, but I think the point stands?

*Also not a cryptographer!!*