My main complaint was your implication that large numbers of JS developers ("many") would benefit from this low-level crypto API in the browser. I think it will

My main complaint was your implication that large numbers of JS developers ("many") would benefit from this low-level crypto API in the browser. I think it will have the opposite effect, leading to a million differently-broken encrypted message protocols, encouraged by the browser offering just enough rope to shoot the users in the foot. You don't really address this issue, but point to what you claim is the greater good: more freedom to implement any protocol the dev pleases. In your opinion, the gain from this is worth the cost of a few million compromised users (story out yesterday: Pandora doesn't manage keys for encrypting cookies properly due to a developer choice). The only problem with this argument is that there is no limit on browser JS developers' freedom today. They can implement anything they want, plugging in AES ECB blocks wherever they want. For example, consider Meebo, which sent a JS RSA implementation plus the key itself as a substitute for SSL. There was nothing wrong with their JS implementation of raw RSA (as far as I remember), but the whole problem was that crypto doesn't work if the key and cipher implementation are both modifiable by an attacker. I find it funny that you agree with me in the end: You can't escape from the fact that crypto is hard, and that there is always going to be a segment of developers who will simply not get it right. The goal is not to prevent every failure, but reduce the number of devs who will fail. The way to do this is to offer high-level APIs that reduce the number of such victims. Currently, the W3 API will victimize millions of users via any clever developer who has read Applied Cryptography. With a high-level API, you reduce that set of devs to those who are determined to get it wrong (e.g., post private keys on their website today). I think you agree that's a smaller set (though how much, I don't know). The W3 low-level API will encourage more flaws while offering no improvement over the current JS security model. The fact that you can do things like Meebo (but with higher performance and cred with managers that "it's the standard"), is a net loss of security, not gain. Too bad.