Shocker. Likewise, if you ever access SpiderOak from a browser you're equally hosed.

If you don't trust the server then you can't expect thin client apps served from said server to be trustworthy. It's bizarre to me that people don't get that.