World Engineer's answers are pretty good, but I think you're not talking about security as such, but piracy and counter-piracy measures. In that sense:
What is too much security for the end user?
Anything which the user considers too visible / obtrusive. This is highly dependent on the nature of your software - specialised software typically gets away with having stricter activation requirements. E.g. I may put up with a dongle for a 10 00$ application, but have refused to purchase 50$ games and applications because of DRM / "always online" requirements.
What is too little security so the hacker can just push through without issue?
If we're going down this path, I would say no activation at all, or incorrectly implemented checks (e.g. having everything boil down to a single
if in your code.
If your software becomes popular, what should you expect or accept as acceptable loss?
How do you propose to measure this loss, exactly? Remember that a pirated copy is not necessarily a lost sale - there's a good chance that your software is being pirated because that person didn't think it was worthwhile paying for it.
To actually answer the question, nobody knows. Estimated piracy rates are generally pretty high. One example is Ubisoft claiming a piracy rate of 93 to 95% and this list by country showing it to be quite high in general. Yet somehow, they are still in business. I also believe that purchasing power inequalities play a large role in it, and unfortunately there's no easy way to deal with that. Basically, 100$ for Windows may seem cheap for someone in the US, but may be a year's savings for a Zimbabwean. Do you really think they will buy it, and is that pricing fair in the first place?
Why should we accept black hat hackers as a way of life?
Well, for one, it's the nature of computing at the moment. If you are handing out your application to be run on other people's hardware, there isn't much you can do to avoid them messing with it. There will always be people who crack software for fun, profit, social standing, political motivations, whatever. And more importantly, it's an uphill battle - nothing is uncrackable, and by investing in stopping piracy, you may irritate legitimate users and waste your valuable time.
So basically, it's in your best interest to play along - it's a "battle" you can't win.
Some alternatives / solutions to consider:
- Make the application web-based, and sell it as a service, or make it partially dependent on some hosted service (the actual meat of the app, not just activation). Edit: coincidentally, the latter part is what dongles actually attempt to do; given time, it can also be reverse engineered and emulated.
- Incentivise users to buy the real thing by offering them value-adds. Frequent updates and new features can make your app a moving target, even if it runs on the client.
- Alternatively, if played cleverly, "DRM-free" can also be a powerful marketing tool. You gain goodwill from the community, and some free marketing. A good example was Galactic Civilisations, a relatively unknown game which enjoyed stellar success after a huge publicity boost for being DRM-free.
Edit: as a final summary, I'd put it this way: either turn your application into a service, or (if that's not possible), put in the minimum amount of DRM to make it "good enough" and move on. Rather invest your time and energy into giving your real users value-adds, etc.