If I were to write a web application using openpgp.js (http://openpgpjs.org/) for creating PGP encrypted/signed messages and if I stored the user's private key in localStorage, would this be vulnerable to the same complaints about JavaScript cryptography on Matasano's webpage (http://www.matasano.com/articles/javascript-cryptography/)?
As far as I can tell, the main points outline by Matasano are:
- "Secure delivery of Javascript to browsers is a chicken-egg problem." (This could be fixed by using HTTPS)
- JavaScript isn't well suited to cryptography
- Browsers are too complex for cryptography since they have the potential to contain multiple attack vectors.
If localStorage isn't the best place to store something sensitive like a private key, what would be a better place?