SpiderOak/crypton — pull request #128 by dhain (2014-01-01 21:09:23+00:00)
Title: Server can overwrite client secrets

In `core.js`, in `crypton.authorize` each property from the response body (parsed as JSON) is copied into the Account object. A server can therefore send a response body containing the JSON representation of properties named `passphrase`, `keypairCiphertext`, `containerNameHmacKeyCiphertext`, and `hmacKeyCiphertext`.
This causes the client's Account object to have those properties overwritten to contain values provided by the server.