DataSafe password encryption ...not really

You can find bellow my config :

very simple, with no special customization except the added login url (/user_login.php) and the username/password parameters.

 I'm sure that I am using the correcte parameter names, because they are encrypted/obfuscated when they leave the browser.

I've been told that this profile doesn't protect from "malware in the browser" and that is what my little JS script mimics . is it possible that it's the answer ? or am I hitting a bug here ?  

If anyone else can make the same very quick test and ensure that the JS script above displays the parameter values it would be very nice ,

many thanks,

karim