Top all-time · #13386
Aki Björklund
Personal blog · akibjorklund.comsecurityprogramming
Aki Björklund's personal blog at akibjorklund.com covers security and programming. Since 2011, 6 different Hacker News readers have linked it 8 times. It is still writing: the last post was on 2026-06-02, and you can follow it by feed.
Too few sampled comments (6) to say how often HN recommends it.?
Why HN links it
HN readers link Aki Björklund's 2009 post "SuperGenPass is not that secure", which says the bookmarklet's UI runs in the page DOM, so page scripts can read the master password.
Summarised by Claude from a sample of 6 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
web developer
Most-linked posts?
- /2009/supergenpass-is-not-that-secure4 people · 4 mentions · first linked 2011-04-11
What Hacker News says?
It had overheating issues if your cat sat on top of it, with the side effect of cat fur being sucked into it. Reference: http://akibjorklund.com/2008/the-cubes-fatal-flaw-cats
Comment linking /2008/the-cubes-fatal-flaw-cats
on “Mac Pro”Is it still completely vulnerable? http://akibjorklund.com/2009/supergenpass-is-not-that-secure
Comment linking /2009/supergenpass-is-not-that-secure
on “Metasploit Rails 3 Remote Code Execution Hours Away”Not entirely on-topic but SuperGenPass and probably similar bookmarklets has a security problem: http://akibjorklund.com/2009/supergenpass-is-not-that-secure
Comment linking /2009/supergenpass-is-not-that-secure
on “One way to fix your rubbish password database”SuperGenPass has a serious DOM vulnerability. The link has a live demo. http://akibjorklund.com/2009/supergenpass-is-not-that-secure The SuperGenPass UI is rendered within the DOM of the current page when you click the bookmarklet. The UI is where you enter your master password. And because the UI is part of the current page, any script running in the page can read your master password. Remember that script can be e…
Comment linking /2009/supergenpass-is-not-that-secure
on “Don't Store Passwords, Generate Them When Needed”Nice summary. I wish I had seen it about a month ago when I spent an afternoon hunting through comments here and elsewhere looking for alternatives to 1Password. (No Linux or WebOS is my main issue.) I see that you're using SuperGenPass. I loved and used the SGP bookmarklet for a while, but stopped when I read this article: "SuperGenPass is not that secure"[1]. Read the article, try the demo, then STOP USING THE BOO…
Comment linking /2009/supergenpass-is-not-that-secure
on “Toward Better Master Passwords”"The SuperGenPass UI is rendered within the DOM of the current page when you click the bookmarklet. The UI is where you enter your master password. And because the UI is part of the current page, any script running in the page can read your master password. Remember that script can be external too, as in advertisements or widgets of some kind." - http://akibjorklund.com/2009/supergenpass-is-not-that-secure There are…
Comment linking /files/2009/10/supergenpass-vulnerability-demo-2.html
on “Stop using bad passwords. Start using Vault.”