[g-b-r]

We're talking about normal browsing, not webapps performing their encryption

[isilofi]

Webapps are also vulnerable because the Javascript can be manipulated in a MitM attack.

The only way around this would be a "real" app.

[g-b-r]

True