The server operator could modify the javascript it sends to the client, so that the client sends either the key or the plaintext to a place of the operator's choosing.
That would fall under the same category as MITM in this case. You still need to trust the server (or a server, if you prefer)
You could move the client side code to a browser addon/extension, but you'd still have the problem of trusting the extension to behave
It runs on ZeroBin, which uses client side javascript to generate a random 256bit AES key, then compress and encrypt the text before sending it to the server. Comments are also compressed and encrypted. The key is never seen by the server, so the server can't decrypt your data.
It uses the Stanford Javascript Crypto Library for its AES code, and its codebase is available on github.
The system is vulnerable to an MITM attack, also a server admin may be able to reveal the poster's identity, but not the post's content
Even better is the researchers' own blog post
No, you're thinking of SSLstrip which methodically strips HTTPS references. This is a different attack, where the client accepts certificates signed by any certificate that has a valid chain
You can get an E-IPS panel, I recently got me a Dell 2209WA screen, was fairly cheap.
Always draw your curves, then plot your reading.
