Can a clever hacker still steal everyone's money from the blockchain.info wallet? Blockchain.info claims:


  We cannot (and don't want to):
  
  
  View your balance
  View your address book
  Make transactions on your behalf
  Confiscate your wallet
  Lock you into our service.
  


They do this by only storing the encrypted wallet file containing the private keys, and letting the web client do the decryption and signing using the private keys without ever communicating them using the server. This means it is indeed true that the blockchain.info can't make transactions on your behalf. 

I used to think this also meant that, if a hacker broke into their servers, they would not be able to steal everybody's bitcoins, because the private keys are not stored there. 

However, now I'm not so sure. Couldn't the hacker simply change the server code to send javascript to the web client which, when executes, decrypts those private keys and sends them back to the (now-hacked) server? 

It would take longer, as everyone would have to sign in to be compromised... but they'd still be able to steal a bunch of Bitcoins.

Am I missing something or is this indeed the current state of affairs with blockchain.info?

(Note this is not meant to be a dig at this particular website; it's really more of a security question in general.)
They anticipated this type of attack and they are monitoring their JavaScript files, check this website of theirs http://blockchain-status.com/javascript_verifier

Also, CloudFlare (the reverse proxy they use) can modify the Javascript on the fly (CloudFlare is at the other end of the encryption for your browser, so SSL here only secures the connection between you and the CloudFlare machines, and optionally CloudFlare to Blockchain.info, you're not directly connecting to Blockchain)

It is true that the client-side script does not send the password to the server but you actually need to send your wallet password to use their old wallet API (it's being deprecated) and if a hacker can somehow control their servers, it is possible that the hackers can read the unencrypted wallet from the memory without having to inject malicious client scripts, even if we assume they are not saving them to the disk.