Mattt-triple-t was our intern at the Yahoo! Developer Network last year and sent us this a couple of weeks ago. It's a really solid example implementation. You should play with it.
Mattt-triple-t was our intern at the Yahoo! Developer Network last year and sent us this a couple of weeks ago. It's a really solid example implementation. You should play with it.
If you mean, as an example of JS interactivity design, then yes. I agree. It's slick and it works as advertised.
If you mean, as an example of a safe extension to the most security-critical part of your application, then no. It's the opposite of solid. It's essentially publishing information that can be used to recover your password to the world.
I'm mystified as to how people could think this is a win.
I'm not sure I agree with your security analysis though. The concept is to provide a visual cue for the password that's hard to manually reverse engineer.
Also, I doubt my cat really cares about guessing my password.
SSL vs. password visualization, which is worse? Depends on your threat model, I guess. It's academic to me. You should be using SSL also.