The idea of "perfect security" is a myth. The best approach to security is doing exactly what google is doing: Off the top of my head: 1.) Spend a lot of tim

The idea of "perfect security" is a myth. The best approach to security is doing exactly what google is doing: Off the top of my head: 1.) Spend a lot of time and money on security engineering. 2.) Constantly update, make sure it is not a hassle for users to update. Preferably force them to update, design with patching and updates built in and with minimal impact. 3.) Hire/pay a lot of people to try to break your shit. 4.) Keep a keen eye out for undisclosed vulnerabilities/exploits on the black market and have an easily accessible reporting mechanism for white hats which you do not pay. 5.) Notify the crap out of your uses when something goes wrong. You can easily see why programs such as old versions of Adobe Flash and Reader were terrible from a security perspective if you try to compare them to the above criteria. Talking about complexity and operating system design opens up a new can of worms. With iOS I think Apple is taking the extreme approach which works for like 99% of people who are not power users... 1.) Isolate everything. 2.) No third party apps that Apple does not approve. 3.) Everything is digitally signed. 4.) Limit apps from running other code. 5.) Be able to kill switch apps or wipe the device remotely.