Regardless, what do you think of someone who publicly calls something a terribly insecure idea, and then reacts with snark and doesn't actually attempt to crack the system when the opportunity is put before him by someone willing to bend over backwards to help him crack it?
Propose a plan to actually crack the system. Do you want the database? Do you want to control the network where I log in?
Engineering doesn't work that way. Your proposed solution doesn't become more sound simply because you feel aggrieved at the way people react to it.
Also: it's deeply dishonest to suggest that the only reaction you've received to this design is "snark". As I pointed out above, with a link and everything, and as you yourself acknowledged in your original post, you've been given a litany of reasons why your proposed design is flawed. You just don't seem to like hearing them.
I'm attempting to give those who believe that JS crypto should never be used a way to make a clear public demonstration. What better target could you ask for? A web application hacked together in a few hours by someone with no training in computer security who isn't even a professional software engineer and who is willing to arrange scenarios favorable to the attacker.
I'm not aggrieved by the negative reaction. I have no skin in this game. I don't earn anything if people walk away believing this idea is more secure. I just wish you wouldn't keep repeating the same canard about having to bootstrap the crypto on every use while attacking the messenger and the manner in which the message is being delivered.
In other words, sometimes, you have to put your money where your mouth is. The OP is doing that. You're not.
Instead, I'm inclined to believe you just can't.
If you can tell me this English word, I will paypal you $10.
--
Despite no one winning my "contest", my sticky-note encryption system is not particularly secure.
Different systems are secure against different threats. Sticky notes are secure against people who can't get physical access to their location.
The question in this case is what attacks this experiment is secure against.
I've taken the sticky note down. It had the word "contrite"
There were plenty of exploits you could have done, without having local access to my machine. Just one example- If you view my profile, you can determine the company I work for. Use linked/etc to message someone there, and offer to split my generous reward with them, if they tell you the word.
Just because no one took me up on my offer doesn't mean my sticky-note was secure.
Yes, of course it was a silly "contest", but that's the point - Contests like this don't prove anything at all about how strong or weak your solution is.
Where are these people that are actually suggesting plausible attacks rather than just mocking the idea of a contest? I don't see them.
Those are creative solutions to your contest. I should have been cleverer.