[eli]

This idea (encryption in javascript in a regular web browser) comes up very often on HN. It's not a good idea. Since I have no way to trust/verify that the encryption code itself has not been tampered with (beyond HTTPS) then it is only secure as HTTPS.

You've added a fair bit of complexity for no specific benefit; likely a net loss in terms of security.

[willholloway]

What about:

1) Comparing hash of the js files loaded externally.

or

2) Keeping hash authenitcated javascript files from local disk?

[eli]

1) Compare the hash to what exactly?

2) Then why not just store the files themselves to local disk? They can't be updated anyway. Or, indeed, just install GPG.