I've recently been doing some research on Host-Proof Hosting, specifically in a web app environment. It seems like a pretty rock solid method of security, but I'm certainly not a security expert and would like to get some other opinions.
Aside from obvious client-side vulnerabilities (key loggers, physical observation, etc.), what are the vulnerabilities in Host-Proof Hosting?
As a note, the web app that I'm researching for uses SSL for all connections, so a basic man-in-the-middle attack wouldn't count here (although, I don't know that it would matter much).