0

I have some questions about the listed Web wallets. Can someone please help me understand?

  1. The bitcoin.org page for some web wallets says "Shared control over your money" (e.g. BitGo, BTC.com) while for Coin.Space says "Full control"

What's the difference? Why does only one Web wallet (Coin.Space) give you full control, why not others?

2.

Why are these wallets not listed on bitcoin.org/en/choose-your-wallet: StrongCoin, Blockchain.info, Jaxx

Why are these not listed on bitcoin.com/choose-your-wallet: Coin.Space, Xapo

  1. Some web wallets (e.g. Coin.Space, Coinbase) say "Vulnerable environment" while others do not (e.g. BitGo, BTC.com). Some like Jaxx list "Secure environment". What is the difference?

  2. Some says "Remote app", some do not. What is the difference?

I’d be thankful for your help!


Additional Questions (from comments):

  1. After reading about HD, BIP and understanding (somewhat) how blockchain.info's (bc.i) recovery works, I looked at a few multi-sig wallets briefly: BTC.com, BitGo, GreenAddress (GA). It appears that their recovery would be more troublesome compared to a mnemonic phrase method. Especially, the mention of "nLocktime" by GA was lost on me. I'd love your thoughts/feedback please.

  2. About your comment: "can easily be stolen by the wallet provider". Is it because they know the mnemonic phrase? Is it that they generate it so they know it? If so, would you please recommend a wallet that is not easily stolen, but gives full control of key and easy to recover? I suspect with multi-sig, one would be dependent on pre-signed transactions being sent (by the wallet company), which may not happens if it suddenly disappears. Please correct me if I've completely misunderstood things.

1

What's the difference? Why does only one Web wallet (Coin.Space) give you full control, why not others?

Click the question mark icon next to each field and it will give you a more detailed explanation of what that qualifier means. For example, "Shared Control over your money" says this:

This wallet requires every transaction to be authorized both by you and this third party. Under normal circumstances, you can regain full control over your bitcoins using your initial backup or pre-signed transactions sent by email.

"Full Control" says this:

This wallet gives you full control over your bitcoins. This means no third party can freeze or lose your funds. You are however still responsible for securing and backing up your wallet.


Why are these wallets not listed on bitcoin.org/en/choose-your-wallet: StrongCoin, Blockchain.info, Jaxx

Bitcoin.org has a listing policy for wallets. Wallets must meet certain criteria for security, usability, and privacy in order to be listed on the website. The full criteria is available here: https://github.com/bitcoin-dot-org/bitcoin.org/blob/master/docs/managing-wallets.md. Wallets which do not meet those criteria are either not added or are de-listed (as in the case with blockchain.info).

Why are these not listed on bitcoin.com/choose-your-wallet: Coin.Space, Xapo

AFAIK bitcoin.com does not have any criteria for a wallet to be listed. Presumably wallets are not listed there because no one has bothered to ask them to list a wallet.


Some web wallets (e.g. Coin.Space, Coinbase) say "Vulnerable environment" while others do not (e.g. BitGo, BTC.com). Some like Jaxx list "Secure environment". What is the difference?

Again, clicking the question mark icon will tell you. For "Vulnerable Environment", it says:

This wallet can be loaded on computers which are vulnerable to malware. Securing your computer, using a strong passphrase, moving most of your funds to cold storage, or enabling two-factor authentication can make it harder to steal your bitcoins.

For "Secure Environment":

This wallet is loaded on mobiles where apps are usually isolated. This provides a good protection against malware, although mobiles are usually easier to steal or lose. Encrypting your mobile and backing up your wallet can reduce that risk.


Some says "Remote app", some do not. What is the difference?

For "Remote App":

This wallet is loaded from a remote location. This means that whenever you use your wallet, you need to trust the developers not to steal or lose your bitcoins in an incident on their site. Using a browser extension or mobile app, if available, can reduce that risk.


It appears that their recovery would be more troublesome compared to a mnemonic phrase method. Especially, the mention of "nLocktime" by GA was lost on me.

It can be more secure because in order for someone to steal your Bitcoin, they would need to compromise more than just your mnemonic, they would also need to compromise whatever two factor authentication you have set up in order to spend your coins.

The nLockTime thing is a special transaction which cannot be confirmed until after a certain date or block height. This transaction is for the possibility that GreenAddress becomes unavailable for some reason but still allows you to access your money.

About your comment: "can easily be stolen by the wallet provider". Is it because they know the mnemonic phrase? Is it that they generate it so they know it?

No, it is because you are using whatever web wallet software they serve to you at the time you visit their website. You have absolutely no control over what software you are actually using (as in what the code is). So that software could be malicious, and there would be nothing you could do about it. For example, suppose blockchain.info has been legally obligated to confiscate your coins. They could simply just serve you and only you a modified version of their software which sends all of your private keys back to them in an unencrypted form and all transactions that that software makes just sends the coins back to blockchain.info. This does not even have to be blockchain.info being malicious; it could be a man-in-the-middle attacker who has hijacked your connection to blockchain.info and served you the bad software.

  • Thank you!! After several hours of searching/reading, I'm getting "some" understanding. One thing is still not clear, on the bitcoin.org page, why does only coin.space web wallet say "full control over your bitcoins". Is it unique from the rest? (I've read one should only choose a wallet that gives full control). – kayan1 Aug 30 '17 at 23:18
  • Because with coin.space you can spend your coins without any involvement from coin.space. The other wallets use multisig where the wallet provider holds 1 signing key for all of your addresses so that you use a 2fa thing for it. It looks like coin.space is like blockchain.info where you have full control over your private keys in theory, but they can easily be stolen by the wallet provider. – Andrew Chow Aug 31 '17 at 0:08
  • Andrew, thanks for being so helpful. I really respect that. After spending several hours today reading stuff and bugging you, I'm starting to get "some" idea about HD and multi-sig concepts :) Thanks for clarifying. – kayan1 Aug 31 '17 at 4:48
  • 1. After reading about HD, BIP and understanding (somewhat) how blockchain.info's (bc.i) recovery works, I looked at a few multi-sig wallets briefly: BTC.com, BitGo, GreenAddress (GA). It appears that their recovery would be more troublesome compared to a mnemonic phrase method. Especially, the mention of "nLocktime" by GA was lost on me. I'd love your thoughts/feedback please. – kayan1 Aug 31 '17 at 4:55
  • 2. About your comment: "can easily be stolen by the wallet provider". Is it because they know the mnemonic phrase? Is it that they generate it so they know it? If so, would you please recommend a wallet that gives full control of key and is easy to recover? I suspect with multi-sig, one would be dependent on pre-signed transactions being sent (by the wallet company), which may not happens if it suddenly disappears. Please correct me if I've completely misunderstood things. – kayan1 Aug 31 '17 at 5:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.