Hacker News Reader

1. Not using any persistent identifiers when they're transferred as plain text.

2. Not allowing to retrieve any information based on persistent identifier alone i.e. require authentication for all resources (unless all data under some resource was explicitly meant to be publicly available).

3. Optionally, try to get rid of any long-term persistent identifiers (of course, besides Microsoft account ID which is meant to be persistent), in favor of ephemeral ones that are reasonably short-lived and rotated frequently.

Not include them in the (sub)domain name?

So it's fine to use them in the query string?

That would at least not reveal them in DNS queries, or the TLS SNI

Well they wouldn't be included in DNS lookups if they were not in the host name.

So long as the query is passed over HTTPS, it is encrypted. But the domain/subdomain info is not concealed by HTTPS.

The profile picture URL looks like “https:‍//cid-___.users.storage.live.com/___”. Both the host part and the path part contain your CID. The CID in the host name really doesn’t have an effect (from the client’s perspective); you could use, for example, “cid-0000000000000000.users.storage.live.com” instead, or really just “storage.live.com”.