I've recently been thinking about the same problem and here's what I came up with: a bootstrap javascript script which takes the user's password and decrypts another javascript file with it and runs that. That javascript file then proceeds to decrypt other files and build an interface with them. This way, the server could not change files without your consent. You could maybe even use the Application Cache [1] to notify the user when the server changes the bootstrap file, or some kind of mechanism where the browser, instead of a bootstrap file, takes the user's password and decrypts the first file (something like [2], perhaps).
How does this help? If it's running on the server, you just insert a breakpoint right after the decrypt function call, put whatever code you want, then continue running.
Edit: I understand your comment now. No, I meant that the bootstrap script is running in your browser.
Yes, you're right that it's very far from perfect without browser support for decrypting files, but it reduces the amount of files on the server you need to monitor to one (or a couple) and it would make targeting someone harder (by using appcache). I'm not a security researcher, though.
Comments
I've recently been thinking about the same problem and here's what I came up with: a bootstrap javascript script which takes the user's password and decrypts another javascript file with it and runs that. That javascript file then proceeds to decrypt other files and build an interface with them. This way, the server could not change files without your consent. You could maybe even use the Application Cache [1] to notify the user when the server changes the bootstrap file, or some kind of mechanism where the browser, instead of a bootstrap file, takes the user's password and decrypts the first file (something like [2], perhaps).
[1]: https://developer.mozilla.org/docs/HTML/Using_the_applicatio...
[2]: https://en.wikipedia.org/wiki/TLS-SRP
How does this help? If it's running on the server, you just insert a breakpoint right after the decrypt function call, put whatever code you want, then continue running.
Edit: I understand your comment now. No, I meant that the bootstrap script is running in your browser.
Yes, you're right that it's very far from perfect without browser support for decrypting files, but it reduces the amount of files on the server you need to monitor to one (or a couple) and it would make targeting someone harder (by using appcache). I'm not a security researcher, though.