By typing the master password into the destination form, then replacing it, the master is potentially revealed to any target site that might use JS/AJAX to view the password before form submission. So, this is not helpful against the "one bad (or compromised) site steals my master password" threat.
If SuperGenPass were to pop its own window, calculate the site-specific complex password, then insert that into the form, it could probably be safe -- but would still need very careful design. (Once a bookmarklet starts interacting with a page, it might reveal its internal state to that page.)
Yes, that is still a threat, and I would love to see SGP's algorithm make it into native addons for Firefox, Chrome, etc, triggered by a hotkey or toolbar button. However, my initial attempt fell flat when trying to wade through XUL, just didn't have enough time...
And if you're really that worried about a new site, the mobile version can be saved to your local disk and opened in a separate tab, and then copy-paste the generated password into the site in question.
You can always use the mobile version which IS a separate webpage that you type the domain and your password into and it generates your password (which you copy paste).
Comments
By typing the master password into the destination form, then replacing it, the master is potentially revealed to any target site that might use JS/AJAX to view the password before form submission. So, this is not helpful against the "one bad (or compromised) site steals my master password" threat.
If SuperGenPass were to pop its own window, calculate the site-specific complex password, then insert that into the form, it could probably be safe -- but would still need very careful design. (Once a bookmarklet starts interacting with a page, it might reveal its internal state to that page.)
Yes, that is still a threat, and I would love to see SGP's algorithm make it into native addons for Firefox, Chrome, etc, triggered by a hotkey or toolbar button. However, my initial attempt fell flat when trying to wade through XUL, just didn't have enough time...
And if you're really that worried about a new site, the mobile version can be saved to your local disk and opened in a separate tab, and then copy-paste the generated password into the site in question.
You can always use the mobile version which IS a separate webpage that you type the domain and your password into and it generates your password (which you copy paste).
http://supergenpass.com/mobile/
Although this still requires that you trust supergenpass.com to not change the javascript it is serving you into something malicious.