I got nerd sniped with this and thought Iâd send you my opinion:
( Feel invited to disregard )
I would imagine you can use an extra set of k/v pairs to assess that user/site comboâs existance.
essentially give yerself a namespace to be able to safely leave yourself breadcrumbs to be able to constrain userdata exposure and be able to predict the data a bit.
that way, jondoe-myinstanceone can be a different credential than billdoe-myinstanceone
create a key in which you enumerate which sites youve seen thus far. something like [myinstance]
and then create a key for myinstanceone with a val of [jondoe, billdoe]
(hashed somehow such that youâd not be obviously revealing anything to someone perusing datasets looking for âOh InterestingâŚâ )
then you know which sites youâve seen before
and you know which usernames already should have their own set of creds
and theyâre all stored safely⌠because each value and each key is idempotently encyphered before itâs saved⌠so you have to decrypt it before you display it, but since most of the time youâll be able to ask if thereâs a match rather than asking for a list of things to display, the overhead of that isnât quite as painful⌠as you only have to encypher the username and make the query which will tell you if that username is a value youâve seen before for that domain, and therefore whether or not you have a credential stored for itâŚ
without revealing anything meaninfully sensitive,
without overloading upstream things,
essentially
if youâre able to store a thing securely,
and
youâre able to store many things,
and
youâre able to store many distinct things securely,
then you have the foundational isolation necessary to be able to reasonably obfuscate the underlying data, without overcomplicating things too terribly much⌠the downside is that human readability of datasets becomes completely useless as a diagnostic; but thatâs kinda the the point in certain areas, right? :)
anyways⌠hope this helps more than it doesnât?
and if it doesnât⌠well⌠mea culpa⌠at least maybe the knowledge that someone wanted to say thank you for making something cool and had an idea that might make your day a little easier, or might not, but I didnât want to not offer my ⌠uh⌠$.03âŚ