> Even if the encryption is using a known-good algorithm, there's absolutely no way for the JavaScript client to generate anything close to a cryptographically

> Even if the encryption is using a known-good algorithm, there's absolutely no way for the JavaScript client to generate anything close to a cryptographically secure random string for the key. The WebCrypto proposal includes a CSPRNG -- I believe it's now implemented in Gecko and/or Webkit (don't recall which one I saw). However, the bigger concern is that the JS is coming from their servers, which means it's completely compromised by default.