What good is end-to-end encryption if the server you're communicating with is legally obliged to forward your data to a gov database?
In my case, as a service provider, we are encrypting as much as we can, so that we can't even read the data even if obliged to. It becomes troublesome for some pieces of data because we need to decrypt it so that it can be displayed in the website. So if we can decrypt it, as a provider, then we would be obliged to decrypt it for government agencies.
It would be interesting to see what can we do as a provider, to protect our own customers without breaking the law.
Also, the so called protections that it must be a cyber-security threat also hold little check and balance, how about an attack just happening when an agency needs information, or waiting for an attack by baiting it, any protection against creating honeypots to bait certain services? Probably not. Everyday servers and systems are attacked, so it is pretty much open season for getting information. There are no checks and balances and 'volunteering' means nothing. Try getting a gov't contract or deflecting problems without volunteering.
I am glad all these freedom giving up people have nothing to hide such as their business ideas, sites they visit, downloads, emails etc will all be tracked now. I am sure they have something to hide from then. All of this will now be stored not only on their computers and their services, but at the ISP and the NSA now as well. Lots more chances, especially at the ISP level, of identity theft and threats.
Crypto products might be a big market after this.
For instance, SpiderOak makes a point of not knowing what their clients store on their servers, because all encryption happens on the client side, and the key never reaches the server side.
The problem with JS is that the browser may be not good enough, failing to prevent certain attacks from other tabs.
The OS may be compromised, too, so that the data is available before encryption, or the key phrase gets stolen and siphoned out by a keylogger. However good your software is, you can't fight against it.
As memory is getting cheaper, running each domain in a different process in a different container or VM becomes more feasible (see Qubes OS). In a well-insulated environment, JS encryption should be as safe as any other.
Nothing is 100% secure, specially in the web, but anything is better that what we have today.
I will start doing some research on the solutions to this. We are going to do for our clients, what I expect my providers do for me.
Under CISPA, there's no longer any legal obligation to protect your information. There is full immunity for not doing so.
If an ISP suffers a breach and coughs up huge amounts of PII that they handled negligently, they are absolutely still liable after CISPA becomes a law.
The research community has a thing or two to say about that:
https://www.usenix.org/conference/usenixsecurity12/social-ne...