Ironically, though, when people are doing everything in the browser, being unable to do things on the desktop isn't much of a security benefit. In theory, restrictions on cross-domain data sharing are supposed to make things better. But we still see plenty of browser vulnerabilities, XSS hacks, and various sorts of trickery that allow people to exploit web apps in their own way. Moreover, a sizable part of the security is illusory anyway, because the web apps themselves are trying to spy on you in a multitude of ways.