Software Security Impossible in Non-Trusted Hardware? Fundamentally it is impossible to protect software if you can't trust the execution platform (e.g. using a TPM), so what is the point of software security then?

With vendors claim that their white-box crypto / obfuscation technique are the best, is there a methodology or a way to assess the strength of software security?
Recently, ECRYPT CSA organized a white-box challenge where you can publish your white-box implementation for AES-128 without exposing your design and the chosen key.

As a result, all the submitted challenges have been broken in less than one month, which further proves that "obscurity" is never sufficient to protect your assets. 

To the best of my knowledge, there are no formal methods to measure the obscurity strength achieved in a software.