Hehe that's exactly the reason why only Stratum connection should be used for communication with the rest of the world. Electrum server should expose RPC call providing current exchange rate and client should just call it instead of using separate http connection.
Any chance to do this instead of hacking httplib to go thru proxy?
I tend to agree that security wise the best option is a single connection to the server. But it also lacks flexibility. I already did a re-org of the exchange code in my fork, creating "lib/exchanges" subdir, that allowed a choice of exchange using a module for each exchange site. I created a MtGox exchange module in addition to the Intersango one already there by default. The nice thing is foreign users who want some particular exchange rate (eg. Yen, Ruble etc) could select the exchanger in the Settings dialog.
Having only support thru the Electrum server would limit what was available for users to whatever the server decided to offer for quotes. But I could easily create a module that directed quote requests to thru current Electrum server so that users have the option of using Electrum quotes or any other exchanger module available. Right now the server doesn't have an exchange quote api but that could be created.
So at this time it seems the best option is to wrap exchanger modules for proxy use, if one is selected, so that at least leakage won't occur. Then later we could add an exchange api to the server and a Electrum exchanger module for clients. At that point users would have ultimate flexibility in this area. They could choose native Electrum quotes or optional external quotes.
Feedback?