If I were to write a web application using openpgp.js (http://openpgpjs.org/) for creating PGP encrypted/signed messages and if I stored the user's private key in localStorage, would this be vulnerable to the same complaints about JavaScript cryptography on Matasano's webpage (http://www.matasano.com/articles/javascript-cryptography/)?

As far as I can tell, the main points outline by Matasano are:


"Secure delivery of Javascript to browsers is a chicken-egg problem." (This could be fixed by using HTTPS)
JavaScript isn't well suited to cryptography
Browsers are too complex for cryptography since they have the potential to contain multiple attack vectors.


If localStorage isn't the best place to store something sensitive like a private key, what would be a better place?


Question: Robots.txt disallowing URLs
Answer: The original robots.txt specification has no concept of "full" URL. Whatever you specify as value for Disallow is always the start of the URL paths you want to block.

For example, see this robots.txt:

# robots.txt for example.com
User-agent: *
Disallow: /foobar.html


This will obviously block example.com/foobar.html. But it will also block:


example.com/foobar.html?foo=bar
example.com/foobar.html.zip
example.com/foobar.html.for.example
example.com/foobar.html/foo/bar


So, in your case you just need:

User-agent: *
Disallow: /addreview


It will block all URLs that begin with the string addreview:


example.com/addreview
example.com/addreview.html
example.com/addreview_1.htm
example.com/addreview_9999.htm


But it will also block an URL like (let’s assume it exists) example.com/addreviewer, of course. Which may or not what you want (depends on all your URLs you use).

So you need to find a part of a starting URL paths that matches to all the URLs you want to have blocked and doesn’t include any others.