Since these threats are invisible to the user, they will be very dangerous for those using your Webcoin platform.
What security do you implement that will limit damage by javascript, ajax or browser based malware when using Webcoin?
To counter MitB you need out-of-band transaction verification (as opposed to mere transaction authentication.) This can be through SMS verification or through a hardware device like
IBM ZTIC.
SMS verification is what banks use and it's a pretty low hanging fruit. With smartphones you can have a free verification app that doesn't incur the costs of sending an SMS.
The problem is that today there are
already smartphone viruses emerging (MitMo). When these infect your computer, they will ask you to connect your phone and infect it as well.
My current suggestion for best practice would be to offer 1. SMS verification, 2. smartphone/2nd computer verification and for large accounts dedicated hardware. (Important: This hardware must show transaction details on its own screen, so a Yubikey for instance is no good.) The most promising attempt I've seen is Clemens Cap's device - also presented in Prague, I really hope they get it right.
All of the above applies first of all to hosted wallets. With Webcoin we're trying to create something where the provider doesn't have access to your money, so you need to use some additional tricks to be able to offer the features outlined above. I talked about how to do this at my
talk in Prague.
As for the status of my own efforts... I've tried several times to help make it happen, by working with Trucoin, then with Safebit. The three biggest roadblocks that keep coming up are (1) server-side security, (2) the sheer complexity of a system like this and (3) regulatory issues.
That opens some awesome possibilities and might be something I'd work on once some of the more basic features are up and running. 
