Hacker News Reader

But you have to trust them that the secret key never gets transmitted, unless you compiled it yourself.

Also, malicious code can be pushed to the website if you are logging in through that. You have to trust that their infrastructure is safe.