What's the difference? Why does only one Web wallet (Coin.Space) give you full control, why not others?
Click the question mark icon next to each field and it will give you a more detailed explanation of what that qualifier means. For example, "Shared Control over your money" says this:
This wallet requires every transaction to be authorized both by you and this third party. Under normal circumstances, you can regain full control over your bitcoins using your initial backup or pre-signed transactions sent by email.
"Full Control" says this:
This wallet gives you full control over your bitcoins. This means no third party can freeze or lose your funds. You are however still responsible for securing and backing up your wallet.
Why are these wallets not listed on bitcoin.org/en/choose-your-wallet: StrongCoin, Blockchain.info, Jaxx
Bitcoin.org has a listing policy for wallets. Wallets must meet certain criteria for security, usability, and privacy in order to be listed on the website. The full criteria is available here: https://github.com/bitcoin-dot-org/bitcoin.org/blob/master/docs/managing-wallets.md. Wallets which do not meet those criteria are either not added or are de-listed (as in the case with blockchain.info).
Why are these not listed on bitcoin.com/choose-your-wallet: Coin.Space, Xapo
AFAIK bitcoin.com does not have any criteria for a wallet to be listed. Presumably wallets are not listed there because no one has bothered to ask them to list a wallet.
Some web wallets (e.g. Coin.Space, Coinbase) say "Vulnerable environment" while others do not (e.g. BitGo, BTC.com). Some like Jaxx list "Secure environment". What is the difference?
Again, clicking the question mark icon will tell you. For "Vulnerable Environment", it says:
This wallet can be loaded on computers which are vulnerable to malware. Securing your computer, using a strong passphrase, moving most of your funds to cold storage, or enabling two-factor authentication can make it harder to steal your bitcoins.
For "Secure Environment":
This wallet is loaded on mobiles where apps are usually isolated. This provides a good protection against malware, although mobiles are usually easier to steal or lose. Encrypting your mobile and backing up your wallet can reduce that risk.
Some says "Remote app", some do not. What is the difference?
For "Remote App":
This wallet is loaded from a remote location. This means that whenever you use your wallet, you need to trust the developers not to steal or lose your bitcoins in an incident on their site. Using a browser extension or mobile app, if available, can reduce that risk.
It appears that their recovery would be more troublesome compared to a mnemonic phrase method. Especially, the mention of "nLocktime" by GA was lost on me.
It can be more secure because in order for someone to steal your Bitcoin, they would need to compromise more than just your mnemonic, they would also need to compromise whatever two factor authentication you have set up in order to spend your coins.
The nLockTime thing is a special transaction which cannot be confirmed until after a certain date or block height. This transaction is for the possibility that GreenAddress becomes unavailable for some reason but still allows you to access your money.
About your comment: "can easily be stolen by the wallet provider". Is it because they know the mnemonic phrase? Is it that they generate it so they know it?
No, it is because you are using whatever web wallet software they serve to you at the time you visit their website. You have absolutely no control over what software you are actually using (as in what the code is). So that software could be malicious, and there would be nothing you could do about it. For example, suppose blockchain.info has been legally obligated to confiscate your coins. They could simply just serve you and only you a modified version of their software which sends all of your private keys back to them in an unencrypted form and all transactions that that software makes just sends the coins back to blockchain.info. This does not even have to be blockchain.info being malicious; it could be a man-in-the-middle attacker who has hijacked your connection to blockchain.info and served you the bad software.
