Saving default options (length, MD5/SHA) globally is broken (in Chrome)

[craile]

I love this tool and use it many, many, many times a day. However I use a different password length (20 instead of 10) and when I open the bookmarklet I usually have to change the password length manually. Setting this default used to work by putting '20' in the length and clicking the save icon. But at some point, maybe a year ago, this functionality broke. Now it only stores the default length value for the specific web domain that the bookmarklet was invoked on. I'm assuming something changed in the browser at some point (I use Chrome) that saves the default value to local storage FOR THAT DOMAIN ONLY instead of globally

Any way to fix this, or to modify one's bookmarklet to pass a custom password length?

[chriszarate]

I'm assuming something changed in the browser at some point (I use Chrome) that saves the default value to local storage FOR THAT DOMAIN ONLY instead of globally

Yes, because local storage was being abused for cross-domain tracking. :(

Any way to fix this, or to modify one's bookmarklet to pass a custom password length?

I don't think there's currently a mechanism to inject this, unfortunately. The "easiest" way is to make a copy of the mobile version, find and change the default from 10 to 20, host it somewhere, then update your bookmarklet to point to it.

[craile]

Thanks for the quick reply! I suspected it had something to do with the cross-domain lockdown

Yeah, I have a copy of the mobile version hosted as a Google Sites modified to use a default of 20 (https://sites.google.com/view/v7xn1ggqv/home), unfortunately the bookmarklet doesn't seem to work with it for some reason, it always says "SGP may be blocked on this site by a security setting. You may wish to open the mobile version"

It's just the 'n' and 'o' variables that would need to be modified, correct?

n = "https://chriszarate.github.io",
o = "https://chriszarate.github.io/supergenpass/mobile/"

[chriszarate]

That can happen for a variety of reasons, but mostly because one of the assets is unable to load. Example causes:

• Content Security Policy on the "parent" page
• XSS restrictions on the site where the mobile version is hosted (I am guessing this is your issue)
• 404 or some other network error

The browser console should show some indication of the error. You will need a host that allows cross-origin requests. GitHub Pages (where SGP Mobile is hosted) is one of those places.