Comment by rubinlinux

As I understand it. There is research published which suggests HIBP type password checking schemes DO give meaningful signal to potential attackers. EG https://d0nut.medium.com/attacks-on-applications-of-k-anonym... and http://cablej.io/blog/k-anonymity/

It is absolutely not OK to participate in this scheme on a users behalf without their affirmative consent. You simply cant know the context of people's situations.

Even the information that there likely ARE some hits from my IP is a huge signal leak, to me.

Iv been using HA for a very long time and it feels like a betrayal of trust to me.