Add subdomains to shared-credentials.json

A password manager that generates a phishing warning needs to know if it's safe to use the same password at two domains. For example, shared-credentials.json currently covers the case of apple.com and apple.co.uk. It does not cover the case of applid.apple.com, secure4.store.apple.com, idsma.apple.com, etc. (These are domain names encountered when logging into various Apple sites over the past several years.)

Unfortunately, there's no algorithm for parsing the domain name to tell if two domain names are for the same or different accounts. There are a few well known cases, such as alice.wordpress.com and bob.wordpress.com, but there may be less well know sites, such as alantheguru.alanhkarp.com and allantheguru.alanhkarp.com. The Public Suffix List covers some cases, such as apple and chase, but not others, such as schwab and costco.

The shared-credentials.json list should contain all subdomains used for logging into the same account.

Requiring companies to provide updates to shared-credentials.json when new subdomains are introduced might help reduce the prevalence of this practice, which is confusing for users. If entries are used but not provided to the list, password managers will be free to generate phishing warnings for those subdomains, increasing friction for visitors to that site, another reason for companies to provide updates.

Subdomain updates to the list carry less risk than adding additional top level domains. An adversary may manage to add evil.apple.com to the list, but only Apple can ever use that domain name.

Start by reading shared-credentials.json and the existing issue discussion to understand how current domain groups are represented. Determine which subdomains and account relationships can be specified reliably, then document the proposed scope and validation criteria; the issue is complete only when the list has an agreed, reviewable set of additions.

Written by the indexing model from the issue text.