> You can, actually. Just press the 'Not working?' button :) I'm not clear on how this works. It sounds like this submits a request to change the rules for the

> You can, actually. Just press the 'Not working?' button :) I'm not clear on how this works. It sounds like this submits a request to change the rules for the website in question. But what happens in the meantime when you want to get your password? Do you have to click that button and fill out the form each time, remembering the rules you submitted? What happens if multiple people submit that form, but choose slightly different options, i.e. I say "length 15", but someone else says "length 14". Presumably, the site now generates the wrong password for one of those users, and they have to either reset their password, or remember what length they used and keep going through this dialog. > The algorithm is pretty computation heavy, to avoid brute force attacks even with ASICs. If you use Bromite, the privacy settings can cause issues with the website's cryptography algorithms. Couldn't you just derive a base key once, and keep it cached in memory for as long as the app is open? That is, do the slow thing to generate <expanded secret>, and then when you want the password for a given website, you just compute SHA-512("<expanded secret> news.ycombinator.com johndoe") to derive the password. It'd still be slow on first launch, but not if you're keeping the app open while you browse.