"- the security of the source code of itself; browser source code is open for all to see, and to then work around." The author just lost all credibility, in my

"- the security of the source code of itself; browser source code is open for all to see, and to then work around." The author just lost all credibility, in my eyes, with this claim. Security by obscurity is well established as a myth. Like the author says: there is no debate. "- the security of data at rest on the device; on a native app, it’s completely secure. In HTML, the browser is typically not secure and as a result exposes the data it’s accessing within its caches." It's completely secure, except when it isn't. The recent Android signing flaw is a perfect example. "- the security of data in transit; when using HTML, you are pretty much restricted to using SSL. VPNs are just too slow. With native apps, you can also run VPNs and other encrypted solutions, without ruining performance." How does SSL ruin performance? Data is encrypted either way. And how many apps really use anything but TCP streams anyway, such that HTTPS with pipelining is sufficient? Best to leave security experts to make comments about security, eh?