It is not always 4 'bits', it depends on what other similar addresses have entered into the blockchain prior to that one. to find out how many your particular address needs, just type it in the box and it will tell you. As for it being dangerous to the naive user, thats the case with most things in life and is simply unavoidable.
yeponlyone, I'm glad you are neither the developer nor the OP. Otherwise, I'd ask what UX or software company you work for so I can short it.
I happened to have a 1+7 (Base58) sub-string and I trust that FirstBits.com came up with the correct address, but at 1+4 (Base58 - 1B2oH) it was incorrect and does not indicate that it may be incorrect/collision. This is a serious user experience flaw and in my opinion unreliable and thus unusable for money until that is fixed. At some point in the future 1+7 might not be likely unique. Who knows? Certainly FirstBits.com is not warning me!
As for 'bits' in quotes or otherwise, since this is the topic, let's be accurate. 4 base58 characters are roughly 24 'bits'. And as of today, I wouldn't trust FirstBits until well after 40 'bits'.
Otherwise, to the OP, this is a great endeavor. I think this is superior to address shorteners, though it would be nice to use the first-bits in a url such as
http://firstbits.com/1xxxxx. I could foresee using this in the future (as soon as the collision is indicated). Best of luck to you.
I think you are misunderstanding the use of the site.
Firstly, only addresses that have been used in a transaction in the blockchain will appear on the site. If you haven't used an address before, it will not show up if you put the full address in the text box, and there will be no relevant firstbits to use.
Secondly, if the 1+4 doesn't match your particular address, then that means that someone else's address that also has the same firstbits (starts with 1b2oh) had a transaction in the blockchain before yours.
If you want to see the minimum required firstbits for your address, enter the full address in the box, and it will tell you. It is not necessarily unique - it just means that your address was the first address to use that particular preceding combination of characters (case insensitive) in the block chain.
One of my bitcoin addresses, 18TKNbSLTrd3a2W8mtoH5uNzFhWRWNcuHU, was the first address to use 18tkn in the blockchain. So now and forever, 18tkn will identify my address. If another address comes along that starts with 18tkn, then their firstbits will have to be one character longer in length in order to identify their own address (18tknx, for example).
Hopefully that clears things up for you?
Also,
www.firstbits.com/18tkn already works.
EDIT: I see that others have responded, but I'll leave this more detailed response in case you need it.