- Making an app isn't an option. This question is specifically about the security of the mobile browser environment. I do realize that the built-in APIs would be a far better idea.
- Assume that the server hosting the code remains secure, or that the person is running the code locally/offline.
Here's what I've thought of so far:
- Hijacking of the actual transmission (solvable via HTTPS, except MITM)
- Same-origin (solvable via hosting on a dedicated subdomain)