I&#x27;m just not sure how you expect me to take your position seriously and blindly follow it, when your reaction to the information I&#x27;ve presented is to pretend that there&#x27;s literally no difference between WebSign&#x2F;Cyph and something like MEGAChat. I felt that the &quot;HPKP suicide&quot; hack (which is something enabled only by recent Web standards) was a stroke of genius on Cure53&#x27;s part; in the very least generous interpretation, it obviously still isn&#x27;t equivalent to the security of a vanilla Web application, which you seem to be suggesting.<p>As far as Mario&#x27;s statement, while you&#x27;re correct that it doesn&#x27;t explicitly compare WebSign with installing a native app, it was made in the context of a threat model that assumed that level of security. This is why the one WebSign bypass exploit they found[1] was flagged as High — in any other Web app it would simply be a given that the server can serve new code.<p>re: browser extensions, what WebSign provides is comparable, except without sacrificing the security benefits of the restricted privilege set of a standard Web context. (i.e. A vuln in Cyph wouldn&#x27;t put more than just your browser tab at risk.)<p>---<p>1: This was immediately fixed, and then the HPKP rotation scheme Cure53 came up with was soon added on top of that fix.