I previously did some work for an online poker service who had a financial incentive in knowing who was logging in as who and had a custom client with which they could do all sorts of nasty spyware-esque things to the client's machine. And they were still susceptible to hackers.

You have a browser for a client and HTTP. Please, don't end up on HN as sadly yet another cautionary tale for doing security wrong.