Yes, I will install ssl cert in future (at least self signed), understand the risk. Standalone bookmark is great idea, but I am not sure if I can fit script to 2048 bytes. Maybe, I'll make html5 cache manifest to avoid network access.
The basic problem here is that JS is too dynamic to ensure this type of security. Any script running on the page can rebind any value, monitor or trigger any event, or a number of other things. Without SSL or similar, an attacker can inject any script they want into the page.
The simplest variant of such an attack would be a script that replaces your AES function with a ROT13 or other useless cipher. There are variations on this theme, and in the end it's impossible to defend against all of them.
It's still a good, if imperfect, solution for other use-cases.
The CA landscape has changed.... what used to be expensive and required a lot of paperwork is getting cheap/free, and CAs are pushing "Extended validation" certificates and whatnot (the ones that turn your browser bar green, etc....)
Just hit up startssl and get a real certificate... it's that easy. No strings attached.
(Repeating this because I ignored it for about a year until actually checking it out and realizing I'd been an idiot)
ALSO
Given the single utility of this - just inline the scripts you need and avoid the request overhead. You can probably strip out all the functions you don't need to minimize the load time. You could offer a minimized version as well....
ALSO
Very cool! Thanks!
See there: https://www.squarefree.com/bookmarklets/limits.html
I just tested a 1Mb bookmarlet on chromium and it works.