Hacker News Reader

Couldn't MEGA simply change the client-side javascript to just send them the plain text password?

The client could in theory see the javascript running and detect this.

This attack breaks non-browser-Javascript clients.