One idea I had for getting to the tail: filter out sites that appear to use SSO.