Hey man, I loved that article, I read it a while ago. It seemed like it had a pretty simple takeaway: JS crypto by itself is laughable, and JS crypto on top of real crypto is pointless.

I do have a question though -- you say that 'you can deliver the JS crypto with SSL, but then it's irrelevant because the connection is secure,' so I'd like to know, what's your opinion of blockchain.info?

It adds JS crypto on top of SSL, and provides a signed browser extension, for reasons that seem to make sense given its use case.

what about distributed as signed browser extensions?

What's that Google is working on, and it's a much better environment. The code lives on your computer all the time, and you (in theory, assuming the proper browser settings) can make sure you are using a constant version of the code that matches up with what other people are using and auditing.

You can't lock down JavaScript at all. Your browser should (in theory) tell you when a plug-in is asking to be updated and give you the option to say "nope."

In theory, you could even walk up to a brand-new (assuming uncompromised) computer and reinstall the plugin. But you would still need some way of knowing that you were installing the same version you decided to trust earlier. Recognizing checksum pictures, I guess?

It can work but the users have to be able to 'read' the code from the server and sign it themselves. Certain hashes can be considered trustworthy and that would require a 3rd party or being able to put those hashes on paper and compare them.

I would say that signed browser Javascript extensions are my least favorite place to viably deploy crypto.