The video seems to end with an open question about how to trust a JavaScript client to actually be doing the E2EE that you think it is, but this is not as intra

The video seems to end with an open question about how to trust a JavaScript client to actually be doing the E2EE that you think it is, but this is not as intractable a problem as it seems. As long as you can pin a web app the first time you access it, you get at least TOFU security (which is roughly equivalent to downloading a binary app that hasn't been reproducibly compiled from independently audited source code). One way to achieve this is to use the SRI bookmarklet trick[0], and in fact it lets you pin a version of a web app with a specific hash, which can be provided out-of-band by a contact who you trust to vouch for the security of that version. The biggest drawback with this method, though, is that the Data URI appears in the browser's location bar instead of a trusted domain. Fortunately there exists an experimental standard that could solve that problem, namely Cryptographic Hyperlinks[1]. [0] https://news.ycombinator.com/item?id=17776456 https://news.ycombinator.com/item?id=17776456 [1] https://w3c-ccg.github.io/hashlink/ https://w3c-ccg.github.io/hashlink/