At bitcoin.org, there's a prominent notice that an online wallet service could "lose your bitcoins." As I understand it, all bitcoin transactions, and therefore wallet balances, are stored in the block chain, on the peer-to-peer network, so they would not be lost in the event of a service failure. I suppose that the notice is meant to warn against loss of bitcoin addresses/keys, right? As long as I back up my keys locally, I can always recover my bitcoins, right? (Nevermind the case of an untrustworthy wallet service that doesn't protect my keys, or uses them to rob from me.)
The loss refers to a few things, all centered around the simple fact that using an online wallet creates a SPOF (single point of failure).
Consider effects on your balance when:
Online wallet operator incompetence enables
Accidental deletion of private keys for addresses in which your balance is stored.
Security vulnerabilities in proprietary code may let someone else send your balance elsewhere or store your keys for theft if and only if your balance gets large.
Online wallet operator dishonesty enables
Operator or its government(s) to seize your balance.
Vendor lock-in if you cannot derive the private keys yourself (e.g. your password simply decrypts client-side private keys stored on the wallet service).
Theft if the Operator decides to close shop, be it a MAD scenario or theft of balance once private key is exposed.
One should only use an online wallet with these features:
- Service cannot derive private keys
- Private keys are stored encrypted
- Keys are decrypted client-side
- User is prompted to accept code updates
- User is permitted to review client-side code before accepting updates
- Service offers portability
- Once decrypted, private keys can be shown to the user
- User tests import to another wallet client, be it a service or fat client
- Service offers two-factor authentication
- Password and security token authentication
- Security token is decentralized or wholly random (RSA, Google Authenticator, etc.)
- Security token is hardware-based and single purpose (YubiKey)