> Even with that aside, though, most websites nowadays already run to some extent on untrusted hardware (thanks to JavaScript), thus warranting measures to hand

> Even with that aside, though, most websites nowadays already run to some extent on untrusted hardware (thanks to JavaScript), thus warranting measures to handle untrustworthy IPC. From a security perspective it is a very bad idea to rely on untrusted data (i.e. that only passed "client validation", but is not validated again on the server). In other words: If the client tampers with some of its data, only it itself should be affected from any problems that this causes.