3 ms·

They're probably sending a hash of the password, not the password itself, but, no opt-out isn't great.

• vinyl7 2y ago
  Sending a hash seems pointless because I assume sites would salt/pepper the password before hashing so the hashes are different. Or maybe I'm naive about sites following best practices
  • lupire 2y ago
    Google isn't comparing your password to a password inside some other site's server! It's comparing to leaked passwords.
    • vinyl7 2y ago
      If sites leaked passwords were hashes of salt/peppered passwords then it wouldn't match