"The SuperGenPass UI is rendered within the DOM of the current page when you click the bookmarklet. The UI is where you enter your master password. And because

"The SuperGenPass UI is rendered within the DOM of the current page when you click the bookmarklet. The UI is where you enter your master password. And because the UI is part of the current page, any script running in the page can read your master password. Remember that script can be external too, as in advertisements or widgets of some kind." - http://akibjorklund.com/2009/supergenpass-is-not-that-secure http://akibjorklund.com/2009/supergenpass-is-not-that-secure There are even a couple of demos: http://akibjorklund.com/files/2009/10/supergenpass-vulnerability-demo.html http://akibjorklund.com/files/2009/10/supergenpass-vulnerabi... http://akibjorklund.com/files/2009/10/supergenpass-vulnerability-demo-2.html http://akibjorklund.com/files/2009/10/supergenpass-vulnerabi... I tested both demos with the latest version of SuperGenPass (2.01) from http://supergenpass.com/ http://supergenpass.com/