> Why even bother with JS AES? If you're served a court order, > you can be forced to transparently record everything They can try the "Warrant canary" appr

> Why even bother with JS AES? If you're served a court order, > you can be forced to transparently record everything They can try the "Warrant canary" approach. Nothing to lose (but I'm foreign and not a lawyer.) http://en.wikipedia.org/wiki/Warrant_canary http://en.wikipedia.org/wiki/Warrant_canary Still it would be vulnerable to ISP-level MitM with SSL CERT hijacking. Aren't major government agencies (at least technically) able to control root CAs? EDIT: (relevant discussion on the Clipperz forum) http://groups.google.com/group/clipperz/msg/c4e5f76af2e77bf6 http://groups.google.com/group/clipperz/msg/c4e5f76af2e77bf6