I don’t understand how. If I record that my password for Google is xyzzy, but in reality it’s xyzzy123, and 123 is part of every password but not recorded anywhere (other than my mind), how would they work that out? They’d just see that none of my passwords worked. If there is a weakness to this system please let me know.