If this were a blog post with a proposal for changes to implement a workable JS crypto mechanism, that'd be great, but it's a actually blog post about how some

If this were a blog post with a proposal for changes to implement a workable JS crypto mechanism, that'd be great, but it's a actually blog post about how some people are going to implement a "secure" service using a mechanism that's known to be insecure. This isn't a new idea that we're shooting down before it has a chance to fully form. It's something that people have been trying, and making dangerous security claims about, for at least 10 years. It's possible that the core issues are resolvable, but they would likely require substantial changes to the way the web browser works. Whenever people start thinking about a way to make a mechanism like this work correctly, the scope of what's required unravels quickly. At this point, I don't know of any defined or even partially articulated proposal that makes sense and accounts for the bulk of the gotchas. Given that we haven't even been able to get correctly-scopable cookies yet (something the vast majority of the web wants and which has been clearly defined and articulated for many years), I'm not sure that we should hold our breath for this.