About security:

Personally, I simply keep my accounts separate.
Inspired by that sad tragedy last year, by the way, I stick to my multi-tier architecture.
Because I want to be able to trust, so I need to be able to trust my own precautions.

Low amounts / would not matter much:
Using any wallet, incl. webwallet (site could have been hacked).

Mid-amounts, and need to access often:
I am using my own local HZ wallet, on my browsing machine (could have a trojan).
Uptodate firewall, antivirus, Java, kept as clean as possible - but there will never be 100% security.

Larger amounts, access seldom:
Booting Linux from a current LiveCD (read-only = no easy way to get hacked);
Blockchain & HZ & Java unzipped from a USB-stick, incl. checking sha256sums.
Usable within a few minutes, once I got that shellscript ready.

If I will ever own really large amounts, I would definitely learn to sign transactions
on an offline machine (cold storage), so that the privatekeys / passphrases never
enter a computer which is / has ever been / will ever be ... connected to the internet.

Be you own bank = Be your own security department.