Pretty sure that Netflix loads a Flash client (or some other trusted code module) to prevent this. But you&#x27;re right; the browser isn&#x27;t secure enough to enable client-side encryption over HTTP as it would be trivial to MITM and sideload JS code to defeat it.