note 108993 deleted from function.openssl-decrypt by danbrown

Note Submitter: Chris Wesseling ---- A question on using GibberishAES over an insecure channel: Suppose we implement a Diffie-Hellman exchange to establish a shared key, instead of just putting the key in javascript; what keeps our Man in the Middle from serving a version of GibberishAES that implements the API but does no encryption? Even serving just the GibberishAES code via https is easily circumvented by replacing the https url in my original page with a http one. I can try to obfuscate my use of GibberishAES but I'm just entering an arms-race then. Bottom line is: How can I get a trusted version of GibberishAES on the client over http?