Why the decryption key lives in the URL fragment, and where that trick breaks down

SecureNotes keeps the decryption key in the URL fragment so it never reaches the server. Here's the exact mechanism, what it protects against, and the...