You read my whole comment. You know you can't just use HTTPS for your part of it; that you have to have clean-room purity for every piece of content that builds any page that ever deals with any of the mechanics of this code.
Everybody who ever thought "oh, I'll just AES encrypt passwords in Javascript instead of using HTTPS" later came up with "oh, then I'll serve just the JS for this crypto off some HTTPS site somewhere" when someone pointed out how crazy that was. It is nowhere near that easy.
Like I keep telling you, this isn't any more or less secure than any existing solution because the browser is not secure in the face of an attack. Even with HTTPS if I can inject some javscript then it's a one-liner to get your password.
So no, even with HTTPS and your proposed solution you'd still be screwed.
Comments
You read my whole comment. You know you can't just use HTTPS for your part of it; that you have to have clean-room purity for every piece of content that builds any page that ever deals with any of the mechanics of this code.
Everybody who ever thought "oh, I'll just AES encrypt passwords in Javascript instead of using HTTPS" later came up with "oh, then I'll serve just the JS for this crypto off some HTTPS site somewhere" when someone pointed out how crazy that was. It is nowhere near that easy.
Like I keep telling you, this isn't any more or less secure than any existing solution because the browser is not secure in the face of an attack. Even with HTTPS if I can inject some javscript then it's a one-liner to get your password.
So no, even with HTTPS and your proposed solution you'd still be screwed.