Montasano has been vocal in the past about denouncing client side crypto implemented in javascript [1], but I think that their use cases fail to consider a syst

Montasano has been vocal in the past about denouncing client side crypto implemented in javascript [1], but I think that their use cases fail to consider a system in which the server has no need to access the decrypted user data. I helped implement a system for Stellar that does something very similar to what this article describes [2]. User data is encrypted into blobs using a key generated from credentials. The blob is fetched from the server using a hash of those credentials. Neither the server nor a MITM have sufficient information to decrypt your blob, so the security is deferred to each user's computer. If you want a server to be able to access your data, you must acknowledge that there is a non-zero probability that it will become public. If you want truly private data you must encrypt it locally and take the appropriate measures to keep your local system secure. [1] https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/august/javascript-cryptography-considered-harmful/ https://www.nccgroup.trust/us/about-us/newsroom-and-events/b... [2] https://www.stellar.org/blog/wallet-server-version-two-the-electric-boogaloo-the-tech-details/ https://www.stellar.org/blog/wallet-server-version-two-the-e...