However, as all communication with the webserver is encrypted, and sensitive data is always encrypted when stored on disk, the non-Java option also provides a very high level of security.

The next version of standard Java, due in mid-March, will have Transport Layer Security (TLS) 1.2 set by default, thus providing encrypted Internet communications. But the move is not a solution ...