I agree completely. You're sending a prefix which is good enough to reject 99.9999% of candidate passwords. Maybe you're fine sending that prefix to TroyHunt or

I agree completely. You're sending a prefix which is good enough to reject 99.9999% of candidate passwords. Maybe you're fine sending that prefix to TroyHunt or to 1Password because you trust they won't try to use it against you. I'm not passing judgement of whether they are trustworthy. But I do think it should have been mentioned in all the back-patting around "k-anonymity" exactly how useful or not the prefix would be in the hands of an attacker. The argument that "the attacker won't know which user the prefix belongs to" is certainly a big qualifier that would make access to the prefixes less useful. Can we be certain that always holds true? Certainly in the case of 1Password the user is sending their hash prefixes in a way that directly identifies the user's identity to 1Password, and anyone who can snoop on that communication. This is also true for anyone using the HIBO webform directly to submit their favorite passwords.