If the input is already expected to be a hash, you don't need to do compression, and if it isn't just MD5 it. I forget what the property is called, but a hash is supposed to change a lot for a small change in the input. Thus, any n bytes from the hash represents the hash equally well.

> So for user interfaces, where a user merely has to distinguish between different values, or even a situation where two people want to check that they're talking about (probably) the same thing, it remains useful.

Yes, absolutely, as I also wrote. I just wanted (and maybe you do too) to warn that it's not appropriate for sensitive stuff, while the relative complexity of the implementation could suggest that's the case.