The first rule of security is that you have to assume the client's been compromised

... more coming-up soon .....