How so? With Blockchain.info, I have my private keys. They cannot run away with the money!
You have your private keys, but who else does as well?
Do you check the html/javascript every time you use the site?
I'm not saying they're doing anything nefarious, but what's to stop a rogue employee (or group of employees, or anyone capable of faking an SSL certificate) from modifying the javascript and stealing the private keys?
Yes, we could all drive ourselves to insanity worrying about the security of our Bitcoins. The thing is, if some party is clever enough to do script injection on the fly, they are probably going to do some damage and there is little we can do as individuals to avert it.
There's always some risk, but storing your BTC with a company which could access it, but claims that they can't, is probably more risky than other things.
Didn't Dropbox do that?
I believe the facts are that in, what, five years of Bitcoin history, little of that type of security hacking has occurred. When it HAS happened, it was a VERY high profile heist. Your 20BTC wallet just isn't worth the effort to focus on you. Crooks know there is cash in 95% of the houses out there. Do they break into all 95%? No, just the most profitable ones.
The focus would be on blockchain.info, not on you specifically.
Mt. Gox got burned by their own stupidity by incorrectly implementing the Bitcoin protocol. So, nefarious opportunists could use that crack in their code to get paid more than they were entitled to, and Mt. Gox ended up in a piddling mess when their audit came back short of coin.
You believe that?
I use a Blockchain.info online wallet because I like their Android client. They are not an exchange so they never need to have the access to manipulate my wallet balance. I NEVER give them my private key to log in, just an account ID (which is NOT my wallet address) and my password (which is NOT my private key).
So where do you think your private key is stored?
With the standard settings, blockchain.info has an encrypted version of your private key.
When they were down for a while, I was able to take my blockchain.info encrypted wallet backup, which I create via dropbox daily, my private key, Multibit wallet software and have my wallet back and running on my PC in 10 minutes.
That's great, but I don't see what blockchain.info is adding. There are other android clients which don't require you to give anyone your private key (encrypted or not).
In actuality a wallet is just an extrapolation of your balance from the blockchain for just your wallet address. The private key just proves that you have the right to originate transactions using that address via cryptographic means. Anyone that knows your wallet address can discern how much BTC it contains by digesting the entire blockchain looking for transactions that add and subtract from the balance for that address, it's public information. That's the process that takes like three hours when you install new wallet software on your PC, longer if it has to go back to the Genesis block.
You're only using one address for all your transactions?
Blockchain.info got burned and shut down for the majority of the past four days due to a technical issue with MySQL clustering. Plain and simple. In my experience with being a datacenter engineer for 20+ years, you have far more exposure to risk on a day-to-day basis from Murphy's Law than criminals. I've had to recover clustered SQL servers from crashes. It's not pretty and it's not easy or quick.
Electronics fail, paper gets destroyed, passwords get lost/forgotten. Keep your wallet data and especially your private keys as safe as, or safer than, you would fiat cash. Practice safe computing practices. Back yer shtuff up! That's the best you can do. Cryptocurrencies at least have the added advantage in that you can keep multiple copies of credentials safeguarded in multiple ways.
And the security of your private key is only as secure as the
least secure backup copy.
