I have little practical experience with IT security, but I like to look at these issues from the side of the customer. There's a quote I like to repeat:

"If you prioritize security over accessibility, you'll have a perfectly secure system that noboody ever uses, ending up with zero customers. But if you prioritize accessibility over security, you can still build something as large as PlayStation Network."