Yeah, you wonder why they don't open-source their front-end client code so that it can be easily audited to make sure the encryption is done right. It would go a long way to increasing some users' peace-of-mind. Then again, since it's all javascript, you could probably look at the html source, but it's probably minified and obfuscated.