There's a spectrum between "unencrypted webpage loaded over cafe WiFi" and "locally compiled open-source application". You don't always need the latter.

EDIT: Say you're using a web app that encrypts your data on the client. All the executable assets (html, js, css) are static and hosted on a CDN over HTTPS. The app stores your encrypted data to another server. Even if that server is compromised, it's still impossible to access your data without also compromising the CDN (assuming a correct implementation of the crypto and no XSS vulnerabilities, of course).

EDIT2: It would be interesting if you could sign a bundle of static assets that the browser could verify. Maybe as part of the HTML5 app cache. Like a lightweight version of a Chrome app. Add on a restrictive Content Security Policy and it sounds pretty good to me.

1) The application receives no HTML, CSS, Javascript, or code interpreted by plugins from a server in the same context (e.g. not an iframe) as the crypto code.

2) All assets that are run in the context of the crypto code are fixed and signed. No unsigned javascript code (generated at runtime, passed from a server or input to the app, whatever) is permitted to run in any way in that context.

3) The code as signed is completely transparent. It must be possible to audit the code as it would be run, and be able to 'quarantine' updates.

Without all of these things being met, client-side crypto in the browser is completely untrustable. These conditions have never been met.

The whole point of a well-designed, well-implemented cryptosystem is that even if there is a dude sitting outside my house, he's not getting a single bit of my data. This is just as true for government secrets as it is sending a recipe to my mother. This service is broken, as all such services are. Bad crypto is never, ever, ever excusable.

Not if you're the government. Just send the root CA a "National Security Letter" and bob's yer uncle.

But this is besides the point of in browser crypto. The interesting thing is, you need a reliable delivery platform for your crypto code, but this implies you have a TLS connection. So either a third party can break your TLS and modify the crypto code, or your connection is secure in the first place. The scenarios you are then dealing with, is that the server is potentially malicious, but a malicious server just serves broken crypto.

[Edit spelling]

Even if you are an author, assuming you have visited the site over SSL at least once, then it can't be stripped on future visits since the site seems to use HSTS.

There are many things that can mitigate an sslstrip style attack, but coverage from those things is patchy.

At the end of the day, XSS, rogue hosts, etc can own this even if the person "running the show" doesn't want it to happen.

Edit: I note that you now link to nadim's response to http://www.matasano.com/articles/javascript-cryptography&#x2...; -- you reaaaaally should consider linking to the original, or perhaps to https://news.ycombinator.com/item?id=5768837 wherein that article is torn to shreds. JS cryptography is very, very dangerous.

Edit: Also added a link to that discussion next to Nadim's post.