Another commenter just told me about WAICT and there is also an experimental extension called WEBCAT by the freedom of the press foundation. Going to look into these more.

I think that’s the prevailing sentiment in this thread. People would rather trust the site to run the code as advertised and get some added convenience rather than verify the code for themselves.

The point is you can’t prove the server won’t serve you code that won’t take your key and send it somewhere arbitrary.

The front end code could be open source, but you’d still have to trust the web server to actually serve you the same code.

The difference is that JS code served by a web server can change at the server’s whim, and there is no standard way to verify that it matches what you expect except by reading it every time you visit the page.

With an extension, assuming you trust the browser itself, you can check that the extension matches its source, and you only need to do that once per install.

I’ve answered this question in many other threads at this point, but since you’re now the top comment:

Proton Drive and Mail still require you to trust them to serve you Javascript that doesn’t snoop on your plaintext content. They don’t have any way of proving that their web app isn’t taking your plaintext emails (which you can read in your browser and therefore they are visible to Javascript on that page) and sending it back to their server.

IndexedDB is same-origin storage, readable by any script the origin serves. So the keys would not be safe from the host.

On Cryptad’s security page, they say:

some entities still need to be trusted in order to guarantee security: Your chosen CryptPad instance to run the same code as the one published on GitHub

This is the trust requirement I am trying to avoid by making the browser extension open source and independently verifiable.

And how do you propose the web app provides the code to do that encryption without gaining access to the key?