Comments on: ★ SuperGenPass is not that secure

By: lankycoder » Blog Archive » A Fruitless Search for a Password Bookmarklet

Wed, 15 Jun 2011 07:41:07 +0000

[...] alas, SuperGenPass (and any other simple bookmarklet) is not secure in the face of a malicious website that contains JavaScript designed to sniff entry of the master [...]

By: Chris

Chris — Mon, 31 Jan 2011 20:25:20 +0000

Just a note to say that the use of a JavaScript filter like NoScript will prevent this kind of attack on untrusted websites. SuperGenPass, as a bookmarklet, is implicitly trusted while the malicious code is blocked. However, this protection is limited since tyour determination of which sites are "trusted" might be flawed.

By: Karolis Pocius » Slaptažodžių valdymas: SuperGenPass vs LastPass

Karolis Pocius » Slaptažodžių valdymas: SuperGenPass vs LastPass — Tue, 11 Jan 2011 15:31:40 +0000

[...] anksčiau skaitytą straipsnį apie galimą SGP saugumo spragą, tačiau ta saugumo spraga manęs neįtikino, juolab, kad jos galima nesunkiai išvengti naudojant [...]

By: Using a shell version of supergenpass from vimperator/pentadactyl « ChMD

Using a shell version of supergenpass from vimperator/pentadactyl « ChMD — Mon, 20 Dec 2010 17:37:55 +0000

[...] supergenpass is not that secure. Any script executed in the page you are executing supergenpass into is able to see your master [...]

By: geeknik

geeknik — Tue, 21 Sep 2010 04:15:21 +0000

Your demo doesn’t work with the latest version of SuperGenPass and Firefox 4.0b7pre.

By: Tim Anderson

Tim Anderson — Tue, 14 Sep 2010 06:07:11 +0000

steve lewis: in order to open the page in an iframe, some DOM manipulation procedures need to be called. These procedures can be overwritten to steal your password by changing the ‘local’ page to one on a remote server. Even if it did work, the portion of the iframe isolated from the evil stuff on the page would be isolated from SGP.

By: steve lewis

steve lewis — Mon, 13 Sep 2010 17:08:41 +0000

If SGP was changed to open a HTML file in an Iframe saved on the computer containing the application, that portion of the DOM might be isolated from the suspect page. The bookmarklet could possibly pass the domain as a parameter to the HTML file. Would this work as sort of a “secure” version of SGP?

By: Aki Björklund

Aki Björklund — Thu, 09 Sep 2010 04:39:43 +0000

Yes, it will.

By: c

Wed, 08 Sep 2010 22:44:23 +0000

If I use the applet in a blank tab and then paste in the password, will it be secure?

By: Tim Anderson

Tim Anderson — Wed, 14 Apr 2010 10:16:18 +0000

@Andres Riofrio That doesn’t work in firefox 3.5.6