What it should probably say is: "Unforunately, this should not be considered a secure alternative to desktop applications because it is not feasible at all to

What it should probably say is: "Unforunately, this should not be considered a secure alternative to desktop applications because it is not feasible at all to protect against code injection, malicious servers and side-channel attacks." The unfortunate thing is that however cleverly you mess around with Javascript code the current (browser) implementations break all security. tptacek is a little "zealous" about this topic in particular :P (and I actually do see a use for JS crypto as a method of obfuscation, rather than security) but he is right.