Sending secret messages over the distributed web (Build an IPFS JavaScript ĐApp) (medium.com)

This looks like an interesting project, though you may find some people skeptical of using javascript in the context of sending secret messages. I could be in the minority on this one.

Wouldn't exposing window.ipfs on every web page add any attack vectors or break any domain security constraints?