title: Keeping Users Anonymous - Secure DB Only Option - General Thoughts?
body: <p>I'm working on a web app where was considering how to keep user's identities totally anonymous.</p>
  
  <p>However I've come to the <strong>conclusion</strong>, there's not too much I can do - except <strong>concentrate on securing the database</strong> from being hacked.</p>
  
  <p>Is this the general consensus here on StackOverflow or are there any methods I may have missed?</p>
  
  <p>So I thought about:</p>
  
  <ul>
  <li>A straight bcrypt hash and salt however this then leads to contacting the user for various reasons.</li>
  <li>Password resets. I could save recovery question/answer but then of course the answers would need to be readable so that defeats things.</li>
  <li>Another point was say they forgot those security questions or a username I had generated on registration. No way to link them to an account.</li>
  <li>Also what came to mind (assuming I conquered the above) restricting duplicate users. If I hashed/salted searching through would be quite 'heavy' on processing? I could simply keep a long list of emails used but then the issue again linking that to an existing account?</li>
  </ul>
  
  <p>Interested to hear your thoughts.</p>
  
  <p>Thanks.</p>