[FabHK]

According to the description in the linked article, only the first 5 characters of the hash of the password are sent to the API (and that API is not publicly available in the first place, apparently, but can only be accessed via Mozilla or 1Password's own APIs).

What exactly appears to be the problem?

The reasoning for this feature is clearly laid out, and the underlying "ethics of running a database breach search service", while controversial, are also something Troy has thought about very carefully:

https://www.troyhunt.com/the-ethics-of-running-a-data-breach...

[auslander]

> What exactly appears to be the problem?

My trusted browser should not send out any sensitive information.

[yjftsjthsd-h]

Yeah, but that's not sensitive information.

[auslander]

You'd be surprised ... :)

[yjftsjthsd-h]

... yes, I would be surprised if the SHA1 of the first 5 chars of a password was sensitive. If I'm missing something, please share.