> Either your system provides security, or it provides no security. It's not an "amount" of security. Once you're compromised, you've lost. It's not that simpl

> Either your system provides security, or it provides no security. It's not an "amount" of security. Once you're compromised, you've lost. It's not that simple. Yes, once you are compromised that's the end of it. But security is about preventing getting compromised. There are many ways to get compromised, and different ways to mitigate the attacks. If security was that black and white (security or no security) we would all have to use air-gap networks. There would be no internet, no REST APIs, no trusted SSL CAs, we wouldn't be able to use anything. For convenience we accept a certain amount of security risk. The risk we accept, and the security measures we take, are entirely dependent on the sensitivity of the data and the threats we expect to deal with. If the NSA and CIA are after you, nothing is secure, they can physically break in and steal your systems, they have world class cryptographers and a stockpile of zero-day attacks to create trojans with. But for most of us you don't have to worry about the NSA coming after us. We don't even have to worry about highly targeted attacks from criminal gangs. Average people have to worry about semi-automated attacks to scam money out of them, steal their identity, or grab naked pictures. It's likely way easier to break into your corporate network than it is to hack a cloud storage provider and replace their JavaScript code. I recommend you read some of Bruce Schneier's essays and posts, here is good start: http://www.schneier.com/essay-319.html http://www.schneier.com/essay-319.html