As someone who's worked in this domain, I found this very poorly handled. The obvious, privacy-conscious solution, would be to embed all logos in the client, bu

As someone who's worked in this domain, I found this very poorly handled. The obvious, privacy-conscious solution, would be to embed all logos in the client, but this can be unfeasible on the web, depending on the quantity of data. In practice, maybe sacrificing a couple of MB for a one time download isn't such a bad trade-off for privacy (and this will only happen for logged-in users who visit their vault). However, if we want to trade off _some_, but not all privacy (in terms of what logins a vault contains), I can think of a naive obfuscation scheme where random domains are added to a login alongside the real one. Here's how that could work: Preprocessing * assign an order to the logos and hence numerical IDs * pick a hash function (URL / site name) => ID User adds a new login: * is the URL recognized (e.g. accounts.google.com) i.e. do we have a logo for it? * if yes, obtain its ID e.g. 1 * get N more random IDs e.g. 14, 124, 144 * save all of them as the login's metadata e.g. "logo_cache:1,14,124,144" User requests logins (and hence needs logos): * compute (and cache) the list of IDs of logos needed (M entries x N logo IDs each, deduped) * pack and send the logos (hopefully a much smaller subset than all logos)