LOL. http://tobtu.com/decryptocat.php http://tobtu.com/decryptocat.php On a serious matter, javascript (eg all browsers) absolutely needs to change to make th

LOL. http://tobtu.com/decryptocat.php http://tobtu.com/decryptocat.php On a serious matter, javascript (eg all browsers) absolutely needs to change to make the web more trustworthy. I agree with some of the Matasano points[0], but these are the minimum, exhaustively complete changes that would improve browser security: i. js that can be cryptographically signed and verified, a trust model and a browser security policy to enforce it. Think ascii armored GPG signature as a comment for the code it encloses. ii. js native extensions: able to talk to native code that was previously installed iii. js objects that can be made immutable (can't change them in any way) iv. js objects that can be made un-protypable (can't copy or "subclass" them) v. js properties that can be made read-only vi. js properties that can be made private (only the object itself can use them) With folks pushing to make this happen across all browsers, javascript theft of bank passwords and credit card numbers would be much harder. Crypto stuff like the Stanford library would benefit. References: 0. http://www.matasano.com/articles/javascript-cryptography/ http://www.matasano.com/articles/javascript-cryptography/ 1. https://crypto.stanford.edu/sjcl/ https://crypto.stanford.edu/sjcl/