From what I see: * everything is done server side -> trust issues * no encryption, just indexed by a hash -> that means the messages are not store encrypted o

From what I see: * everything is done server side -> trust issues * no encryption, just indexed by a hash -> that means the messages are not store encrypted on the server I would recommend people stay away from your solution, and instead use something like Zerobin: http://sebsauvage.net/paste/ http://sebsauvage.net/paste/ It encrypts everything using SJCL, and if I am worried with the server sending me a modified version of the JS code, I can still keep the code on my own computer but use it to send to the server.