No matter how complicated you make it, a man-in-the-middle pretending to be the device can simply replace your authentication JavaScript. The only way to stop a

No matter how complicated you make it, a man-in-the-middle pretending to be the device can simply replace your authentication JavaScript. The only way to stop an active attacker from doing that is to authenticate the device to the browser, and this cannot be done in unauthenticated JavaScript sent from the device.