[pavfarb]

The whole idea of relying core security guarantee (provable 'no knowledge' on server side) on unreliable mechanism (in-browser cryptography) is feels really wrong.

There are many services which attempt to base their security on in-browser javascript cryptography.

What could be really valuable is not building Yet Another Service That Helps Privacy (but really, doesn't), but investing effort into building trusted execution models within the browser any website could utilize.

Secure apps will follow just instantly.