Here's what all the browsers do (Firefox, Google and Safari all use Google's Safe Browsing service). 1. The truncated hash is checked against local database.

Here's what all the browsers do (Firefox, Google and Safari all use Google's Safe Browsing service). 1. The truncated hash is checked against local database. 2. If there's a hit, send the truncated hash to Google, and receive a list of full hashes for the truncated hashes. 3. Check if the full hash is in that list. If so, warn. I'm not certain that the hash is truncated enough, but the general idea is a pretty straightforward trade-off between the amount of information Google needs and the amount of information your computer needs.