Nate Lawson on in-browser JS crypto: http://rdist.root.org/2010/11/29/final-post-on-javascript-crypto/ http://rdist.root.org/2010/11/29/final-post-on-javascript

Nate Lawson on in-browser JS crypto: http://rdist.root.org/2010/11/29/final-post-on-javascript-crypto/ http://rdist.root.org/2010/11/29/final-post-on-javascript-cr... For example, you (or any powerful-enough third party,as you don't even have HTTPS), could anytime throw in any malicious JS code to get whatever data he wants. And, given that PIN is limited to 4 digits, it's not a protection at all, just a snake oil.