How exactly are websites expected to handle IDs because this seems like a data breach disaster waiting to happen, if not already happening.