2. This one is even worse, because it loads scripts from CDNs, all of which can compromise the encryption on the page.
3. If you're going to put Google Analytics on a page that purports to encrypt data clientside, you might as well just build a front-end to Google Docs, because you've given Google access to the content of the pages anyways. (I think a simplified Google Docs front-end is a fine thing to build, more useful for security than "clientside" encryption).
4. You're encrypting with unauthenticated CBC mode, which is obviously insecure.
5. It's unsafe to compress before encrypting; doing so creates traffic-analytic side channels. There's a whole thread of TLS vulnerabilities stemming from compression occurring at various points of the web stack.
If you really want to build something like this, my recommendation is:
1. Switch from a web page to a web extension, which will obvious most of the serverside dependency problem.
2. Stop using CryptoJS, which is extraordinarily difficult to use "properly", and use a Javascript NaCL implementation instead.
It will be fixed in the next update!
I switched from CryptoJS to TweetNaCl which seemed fit to purpose, and also moved all CDN depencencies locally as well as removed Google Analytics :)
Have a look at https://github.com/picotorrent/picotorrent for one of the more popular projects I run!
