> Any attacker who could swipe an unencrypted secret can, with almost total certainty, intercept and alter a web request. Not really. Modification risks exposu

> Any attacker who could swipe an unencrypted secret can, with almost total certainty, intercept and alter a web request. Not really. Modification risks exposure and some attacks are only possible after hours of compute time. For example if the HTTPS connection uses a cypher that's later found to be insecure then they can analyze the data pushed through the connection after the fact, but they can't intercept the now-closed connection. The NSA layers encryption for this purpose, and I don't really see the harm in encrypting with JavaScript as an additional layer in addition to HTTPS. Plus, there are many places where passive attacks are much more likely than someone that's actually going to change your JavaScript. For example, many organizations terminate HTTPS at the perimeter of their network in order to monitor employee actions on the web. Using JS to encrypt is going to keep your secrets safer there, though some would argue that it's hostile to the orgs that downgrade the protocol on purpose.