I've been hoping someone would ask about this topic, i've been doing a lot of research in the area.
window.crypto.getRandomValues() uses a real CSPRNG
- HTTPS is common and much cheaper now than in 2011
<script> attributes can secure script delivery to make sure what's running is expected
- SJCL is years more mature than in 2011, and no major issues are outstanding
- malleable runtimes don't matter if you don't have XSS, which CSPs are now good at stopping
Furthermore, we now know that HTTPS is not an absolute guarantee of privacy (snowden/heartbleed/crime/breach/etc), but proper end-to-end encryption is. We can also now implement fairly robust, battle-tested, and secure libraries, backed by a more secure JS runtime than what was offered in 2011;
"use strict" widely supported, a CSPRNG, binary structures, web workers with sealed runtime environments etc.
Those are updates to the main points, but if you have concerns about other aspects of client-cryptography, i'll be happy to address them.
Of course, nothing is perfect:
- really old browsers still have issues or can't run new code securely
- user-added extensions can run whatever code they want
- malware can replace the whole browser with something sinister, or steal data pre-encryption
- phishing can trick the user into using something besides your safe site.
In short, i think post-snowden, we should try to keep plain private data off servers wherever we can help it, and solid end-to-end encryption, done right, greatly enhances the privacy of your users and the security of their content.