HTTPS is still an absolute requirement, and Matasano's main point is that JavaScript can never replace HTTPS.   A MITM attack could deliver a custom JavaScript payload that could read any secrets in localstorage, and an XSS payload could also compromise this data.

Matasano is wrong in regards to random number generators in JavaScript. Most browsers provide a very secure random number generator window.crypto.getRandomValues().  I guess Matasano hasn't read the w3c Cryptography API for JavaScript.  This API contains a random number generator that uses the operating system's entropy pool. 

Security of running openpgp.js in a browser with the private key in HTML5 localStorage
I have the following setup and am attempting the use Migration Assistant over Ethernet:


Source machine: Early 2009 24-inch iMac running OS X 10.9 
Destination
machine: Latest MacBook Pro Retina running OS X 10.9
Connection: direct Ethernet cable between machines


When I use Migration assistant following Apple's documentation I pass through the confirmation code step on both machines, and then get as far as the "Checking Source Machine" screen on the destination, and am stuck there for about 10 minutes, at which point the destination machine jumps back to the language selection setup page, and the source machine says "This machine is attempting to reconnect to your other Mac".

At this point I'm at a dead end: Attempting to proceed through the setup again on the destination gets me nowhere, and the only option on the source machine is "Cancel Transfer", which quits Migration Assistant there and ends the whole process.

On the source machine I've turned off LittleSnitch, which I normally have running, turned off Apple's firewall, and enabled file sharing.

What am I missing? Are there other settings somewhere that I need to check? I've also tried using FireWire to connect my machines, but have a different set of issues there.
