[aspenmayer]

The next HaveIBeenPwned is HaveIBeenBurned. May already exist for internal national security use cases.

I see what you’re asking and I share those concerns. This approach seems like it would only stop casual attempts, not determined large scale automated bulk collection, yet it is pitched as if it’s effective or could be improved to be effective. I would expect that its usage would be able to be detected in a photo even if it works, which would itself be meaningful information which could be tracked, like DNT in web browsers.