> But it's one that's never exposed to the actual user.
Why not expose it to the user? Because then they'll want to change it? Are you talking about browser fingerprinting?
We already expose this on the user/email level, where users can link and log in with as many email addresses as they like, under one account (identifier).
Sure, sometimes their usernames are their primary keys. Even if the actual primary key is arbitrary, the primary identity is still exposed to the user, in that they know what their user account is, and which email addresses are linked to it.
Why not expose it to the user? Because then they'll want to change it? Are you talking about browser fingerprinting?
We already expose this on the user/email level, where users can link and log in with as many email addresses as they like, under one account (identifier).