Comment by h8trswana8

I don't see any key being stored client side. So you must be deriving the key from my password?

If that's the case, then my attack would be:

* Loop through a list of common passwords.

* Derive keys from those passwords.

* See if any decrypted results return an ASCII-like result.