There is a possibility to download the file with one’s PII from the dedicated web server. The file might be decrypted by filling the two factors. These two factors are delivered via email and SMS. The sum of these factors is the key from which is generated the hash by, let’s say, bcrypt. This hash is the main password to decrypt the PII from this file. It is transparent for the user. The user only needs to provide these two factors. All processes: scaling two factors, making hash, decryption; are executed in the browser (java) on the client's computer, on the client's side.
In my opinion, it is not good practice and not safe. The process of decryption is on the client's computer. Also, the algorithm is delivered on the client computer. Because it is written in Java so it is possible to find out about the function that is used to decrypt the file. The attacker can steal the file and the knowledge and try to gain access to the file. The main security of confidentiality is based on a strong algorithm like bcrypt.
What is your opinion about this case? Or maybe I am crazy about it and wrong and this is a good and safe practice.