[minhajuddin]

A neat thing about this is that it doesn't send your tokens over the wire which is good security-wise :)

[tosh]

With similar web apps (e.g. hashing of passwords) I was thinking it would be great to be able to show to the user that this web page can't send data anywhere once it is loaded

(I understand that this might be tricky or even impossible (?) to ensure in browsers but it would be interesting to be able to give and prove guarantees like that to the user)

[csours]

In the developer console, I can disable the internet connection for a tab. I wonder if that could be leveraged somehow.

I think it might take quite a few changes though. Very interesting idea.

[staticassertion]

Maybe something with a content security policy?