> but the central server isn't going to reveal much data or anything at least.

As moxie acknowledged himself [1], the space of "all phone numbers" is so small that bruteforcing suddenly becomes feasible. AFAIK they're still working on it but I'm not up-to-date on what's been done since.

[1] https://www.reddit.com/r/netsec/comments/1shi77/textsecure_n...