The thing that perplexes me about this whole debate is that some seem to think there's no inherent trust between parties exchanging encrypted messages.
That seems to be the first important thing to establish here. Alice sends public key to Bob, Bob encrypts the data using said public key and returns the encrypted data to Alice. What guarantee does Alice have that Bob didn't turn around and also post the plain text of Alice's request to [name your favorite social network here]? By the same token, what guarantee does Bob have that Alice won't turn around and post the plain text of the response on [name your favorite social network here]?
So it seems that inherently, even in the most secure of communications, there has to be trust between the parties exchanging the messages.
Please forgive me if this is already being discussed. The thread is rather long at this point so admittedly I didn't read every part before posting this.
EDIT: for correctness, cleaned up references to bob / alice.
So to frame the question in this light, the parties exchanging encrypted messages via javascript (on top of SSL) trust that they're doing everything in their power to maintain the integrity of their systems. Do they increase the surface area where attacks could take place? Sure. But in what way is sending encrypted messages on top of SSL any less secure than sending unencrypted messages on top of SSL.
One argument seems to be that there's no need for the added layer on top of SSL. Then I would ask, so why have passwords at all? After all it's guaranteed that the communications are secure. It looks like the disconnect here is that encrypted messages on top of SSL are behaving as a mechanism to help authenticate the recipient of the messages, like a password, and not trying to act in the same way that SSL behaves as a way to secure communications between 2 parties.
That seems to be the first important thing to establish here. Alice sends public key to Bob, Bob encrypts the data using said public key and returns the encrypted data to Alice. What guarantee does Alice have that Bob didn't turn around and also post the plain text of Alice's request to [name your favorite social network here]? By the same token, what guarantee does Bob have that Alice won't turn around and post the plain text of the response on [name your favorite social network here]?
So it seems that inherently, even in the most secure of communications, there has to be trust between the parties exchanging the messages.
Please forgive me if this is already being discussed. The thread is rather long at this point so admittedly I didn't read every part before posting this.
EDIT: for correctness, cleaned up references to bob / alice.