Password Generator widget

Glen, As of version 1.1 it DID call home (see earlier comments). In version 2.2 the author apparently changed this behavior but didn't outline it in the description. Regardless, the app uses a network resource which is NOT secure (no SSL) in order to grab random numbers even though a true random number generator is available locally. The password generator in Keychain.app is much more flexible anyway.

I agree, the passwords appear to cycle through a predetermined list. I can 'catch up' one instance of the password generator with another instance of password generator with a few clicks. As though they are cycling through the same list. I could see a real security risk by using this software depending on where the list is that the software is using. If the widget is hitting off of some website of passwords that would be bad. If it is constructing a list locally well not so bad. I have seen this also with another product widget called KeyChainHelper. It too will cycle through the same list of passwords, in 2 instances.