By typing the master password into the destination form, then replacing it, the master is potentially revealed to any target site that might use JS/AJAX to view the password before form submission. So, this is not helpful against the "one bad (or compromised) site steals my master password" threat.
If SuperGenPass were to pop its own window, calculate the site-specific complex password, then insert that into the form, it could probably be safe -- but would still need very careful design. (Once a bookmarklet starts interacting with a page, it might reveal its internal state to that page.)
Yes, that is still a threat, and I would love to see SGP's algorithm make it into native addons for Firefox, Chrome, etc, triggered by a hotkey or toolbar button. However, my initial attempt fell flat when trying to wade through XUL, just didn't have enough time...
And if you're really that worried about a new site, the mobile version can be saved to your local disk and opened in a separate tab, and then copy-paste the generated password into the site in question.
You can always use the mobile version which IS a separate webpage that you type the domain and your password into and it generates your password (which you copy paste).
I've been using PwdHash. It's basically the same thing, but it's a Firefox addon. It will automatically hash a password field with the domain if you start the password with "@@" or hit F2. It also has a bunch of guards to warn you if you're entering your password in a field that might be insecure.
Looks interesting but my first thought is that if I want to access my gmail on someone else's computer I would need to install the firefox extension first.
It's just a bookmarklet, not an extension, and if you're not at your own computer, there's a "mobile" version that can be used from anywhere to generate the correct password.
I've memorized a few (non-genpass) passwords for sites that I regularly use from other computers -- gmail being one of them. I also use the mobile version which nuclear_eclipse mentioned.
Comments
SuperGenPass is a much better, simpler, and safer alternative, IMO.
http://supergenpass.com
By typing the master password into the destination form, then replacing it, the master is potentially revealed to any target site that might use JS/AJAX to view the password before form submission. So, this is not helpful against the "one bad (or compromised) site steals my master password" threat.
If SuperGenPass were to pop its own window, calculate the site-specific complex password, then insert that into the form, it could probably be safe -- but would still need very careful design. (Once a bookmarklet starts interacting with a page, it might reveal its internal state to that page.)
Yes, that is still a threat, and I would love to see SGP's algorithm make it into native addons for Firefox, Chrome, etc, triggered by a hotkey or toolbar button. However, my initial attempt fell flat when trying to wade through XUL, just didn't have enough time...
And if you're really that worried about a new site, the mobile version can be saved to your local disk and opened in a separate tab, and then copy-paste the generated password into the site in question.
You can always use the mobile version which IS a separate webpage that you type the domain and your password into and it generates your password (which you copy paste).
http://supergenpass.com/mobile/
Although this still requires that you trust supergenpass.com to not change the javascript it is serving you into something malicious.
I've been using PwdHash. It's basically the same thing, but it's a Firefox addon. It will automatically hash a password field with the domain if you start the password with "@@" or hit F2. It also has a bunch of guards to warn you if you're entering your password in a field that might be insecure.
https://www.pwdhash.com/
It constantly surprises me that supergenpass hasn't caught on more with geeks. It's a pretty elegant solution to a problem everyone has.
Looks interesting but my first thought is that if I want to access my gmail on someone else's computer I would need to install the firefox extension first.
It's just a bookmarklet, not an extension, and if you're not at your own computer, there's a "mobile" version that can be used from anywhere to generate the correct password.
I've memorized a few (non-genpass) passwords for sites that I regularly use from other computers -- gmail being one of them. I also use the mobile version which nuclear_eclipse mentioned.
If you're worried about browser security, there's a command-line reimplementation in python that a friend and I wrote:
http://github.com/gfxmonk/supergenpass
Less convenient, but much less likely to leak your passwords via the browser...
1Password is quite good for the Mac: http://agilewebsolutions.com/products/1Password
It integrates well with Firefox & Safari, and will sync over wi-fi to an iPhone for an encrypted backup.
For Chrome users there's http://code.google.com/p/superchromepass/
Nice! This is pretty much exactly what I was looking for!