In practical terms, there is no such attacker. The ability to watch packets in real time is the ability to silently redirect them, or to insert fake packets into the stream.<p>The traffic manipulation part of the attack is also extremely easy, and not particularly noisy.<p>For most applications, Javascript crypto is completely useless.