I normally keep only small amounts in a web wallet because I heard that web wallets are not secure. The rest of my Bitcoins are kept in cold storage in my safe.
I'm just wondering if you have any experience with web wallets, if they have gotten hacked and/or if you think I should worry about it.
With web wallets you need to be careful. As you stated, if they get hacked and they store your private keys, your Bitcoins are at risk. You really just need to ask yourself:
It should also be added that most web wallets (one example is blockchain.info) encrypts the private key with your password. As the web wallet service does not store your password, your encrypted private key is secure, even if the web wallet service is hacked.
To put this in simpler terms:
Your private key is in essence just a number between 1 and 0xFFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFE BAAE DCE6 AF48 A03B BFD2 5E8C D036 4140 (slightly less than 2^256).
Lets say that the private key the web wallet service generates for you is 1012. In reality the number would of course be much bigger than this as randomly generating such a small number is extremely small. Lets say your password is "bbfh454!fdfK".
If you encrypt the number 1012 with the password "bbfh454!fdfK" the number 5056 is generated (this is only an example and not accurate). The same number (5056) will always be generated with the same password ("bbfh454!fdfK") starting from 1012. The number 5056 is your real private key which is used to access your wallet, but is never stored in the web wallet service database. The number is only generated when you log into your web wallet with your password.
Now lets say you instead try to encrypt the number 1012 with the password "qwerty". This time another number is generated, which could be 205. As 205 is not 5056, this password does not grant you access to the bitcoins in your wallet.
So for this reason no one can ever access your wallet without knowing your password, and no hacker can find out your password by hacking the web wallet service as they do not store your password.
One downside with this approach is that if you forget your password and have no backup of the wallet, your private key and also your bitcoin is gone forever.
Another downside is that this approach isn't secure if your hardware is infected with malware, as the specific malware can check which password you encrypt the private key with.
This feature was introduced with BIP38.
Bitcoin security is about who sees your private keys.
With private keys you are able to do any transaction.
If there is a server that store your private keys then you should trust the server.
But when you store your private key, you are free to choose the security policies that fits your needs.
I wrote a wallet that doesn't use a server to store your private keys: Bolt
Why store your money on some unregulated entity like most web wallets? Either run a full bitcoin node on your computer https://www.bitcoin.com/choose-your-wallet/bitcoin-classic or for more security purchase a Trezor at https://www.buytrezor.com/ and back it up with a "paper" wallet with Cryptosteel.
Any of web wallet secure, if you trust all in a row.
Money (Work) is not for the trust, so all web wallets are not secure.
Here is the discussion about security. Hope you find something useful above the link.
