Ehh, going to come out and say Matasano is wrong here. You can do crypto in JS, just don't download it every time (distribute signed packages via browser add-on

Ehh, going to come out and say Matasano is wrong here. You can do crypto in JS, just don't download it every time (distribute signed packages via browser add-ons). The part of the article that attacks extensions just makes a bunch of assumptions (like, you're going to download scripts and eval them from your extension). It's a leap. Plus that article attacks JS doing crypto that the server will decrypt (which, yes is useless, use TLS). It doesn't address using browser add-ons to do AES encryption, have your data stored on the server in encrypted form, and only decrypted when you download it again. Is this method flawed? Only if you do a web-app instead of a browser add-on. Once you package the client code, it can be just as hard to break as something like KeePass (assuming the add-on itself has a decent security policy, ie don't eval()code from random places). Plus, modern browsers now have "window.crypto" which provides a PRNG. So there goes that argument. The article is just completely wrong in many ways. The only valid point I see it make is about garbage collection and potential for reading decrypted memory directly (MANY languages have this problem, not just JS). One of the points you brought up is extremely valid though: LastPass is closed-source, so it's nearly impossible to truly validate the crypto. Keepass (I also use it) is a much better option, and great when paired with some sort of sync utility.