There is currently no weakness in SHA256 and ECDSA. SHA1 however, is weak and has collisions. Private keys can be calculated if quantum computing can break ECDSA. This means that private keys can be derived from public key. Public keys are broadcasted with a transaction. This isn't a huge threat since a fork can be done easily.

Yup, lamination can help. But, you need to keep multiple backups for redundancy.

A safe and cost effective wallet is a paper wallet but you need a clean android phone to scan qr code and spend it. If you want cheap but very secure storage, get raspberry pi and install electrum on it. Download raw transaction on online computer and sign it on the offline raspberry pi.

Mt Gox was not trusted at all. They had a few security issues including one which crashed the market. The problem with them is that they aren't solvent for a long time. The solution here is pretty simple, have a publicly verifiable hot and cold wallet so that the general public can at least be assured that the exchange is solvent. If not, audit it regularly. Many exchanges such as kraken have audits.

All in all, putting large amount of money in an exchange for a long term is a no no.

Xapo is a relatively good online hot wallet but that's all. If a service have knowledge of your private keys, it shouldn't be safe at all since a hacker can steal them easily. In terms of privacy, Xapo has none. They require users to verify their phone number before using which is a huge turn off for many users. It's required since they probably have to comply with the local regulatory measures.

You might want to change your statement now
http://blog.blockchain.com/2014/12/08/blockchain-info-security-disclosure/
http://blog.blockchain.com/2015/05/28/android-wallet-security-update/
https://bitcointalk.org/index.php?topic=875805.0
There should be more but I can't really be bothered to put all of them right now.

Blockchain.info is definitely one of the more popular wallet services right now. Even with the security issues, many newbies are using it due to it's interface and user friendliness. They don't require captcha for creating an account so I wouldn't say that there's a real growth in adoption rate.

If you leave it out in the open and transfer it everywhere, yes. Blockchain.info wallet.aes.json backups are encrypted by the user's password and would take an attacker sometime to bruteforce it. You can keep it out in the open and you won't get it stolen immediately with a strong password.

Yes. They don't have the user's unencrypted copies in the first place.

No. They do not have any obligations to refund customers or claim responsibility for any damage. Just for the record, its's on their TOS:

They do have a history of refunding users that were affected in their security incidents however.

Paper wallet is a good option but it is rather difficult to spend it. It can be very secure only if you spend it the right way too. Mycelium cold storage spending is a good choice but is nowhere perfect. Even though private keys are deleted after spending from cold storage, it can be hacked in the process of scanning too.

The ultimate best choice would be to buy a raspberry pi and install armory or electrum. It is much safer this way and no compromises are made if you sign it securely offline.

Trezor and ledger are definitely the way to go only if you're spending it frequently.

Price of Bitcoin does matter a lot for now. Many merchants and sites uses fiat to base the amount of Bitcoin to pay and fiat is definitely the most accepted form of currency in the world right now. If the price drops, Bitcoiners would have to pay more and would be at the losing end. This would be the case till Bitcoin becomes widely adopted and people aren't using fiat as a reference.

Broadcasting means that you are relaying the transaction throughout the network. Rebroadcasting means you're doing it again. Transaction usually drops out of mempool in a day or two and to get them in again for chance of miner picking them up, you have to rebroadcast the transaction.

If you do not rebroadcast, the transaction would eventually get forgotten by the network. You can then create a new transaction. Miners and nodes will then relay your transaction and include it into a block. That is unless someone else rebroadcast it again. Nodes can refuse to relay your transaction if any of the output has less than 2730 satoshi or has a very low fee. If that happens, wait for sometime and try to reset blockchain in your wallet. Some wallets rebroadcast it automatically. For Bitcoin Core, you can stop rebroadcasting and delete the transaction from wallet by using -zapwallettx as a flag when starting it up from CMD in windows or terminal in linux. Do still need to wait for network to forget about it though.

It now has confirmations. However, I'll just say out the criterias to make a double spend of an unconfirmed transaction. You must find a miner that has forgotten your transactions and relay it OR you need to find a miner which uses RBF (replace by fee) patch which takes the higher fee. You need to relay directly to it. If majority of the network has forgotten about it, you can create a new one to replace it. If you want to create a replacement transaction, go to https://coinb.in/#newTransaction and input your transaction. Go to inputs and select input, at output, place the outputs, one destination and one change if applicable. The remaining will be your change. After that, sign it by going to https://coinb.in/#sign, input unsigned TX, private key and copy the signed TX.
It's going to be a bit tricky after this:

If the majority of network has forgotten about it, go to coinb.in/#broadcast to broadcast your transaction if it doesn't succeed, try others like http://blockr.io/tx/push.

If the miner has forgotten about it or have RBF patch, make sure the new transaction has a higher fee and try to find a place to broadcast to them directly. Alternatively, install Bitcoin Core and add their node to your conf. Next you can relay the transaction to them by going to help, debug window, console and use this: .

To be honest, I would just try to stop the wallet from rebroadcasting and reset the blockchain on wallet afterwards and send it when the transaction drops out from mempool. It's much simpler.

Previous experience doesn't mean that your future experience would be the same. Coinbase had a 2FA vulnerability before which affected those who had 2FA. If they one day gets hacked, server side, not client side, they will not reinburse you or at most up to $100 with their vault. For vault, you have to wait for 48 hours to receive your coins. SPV Clients like Electrum does not have a central authority and is independent. Can you sign a message with Xapo?

For browsing unsecured websites, without ssl, you would need one. If not, Bitcoin transactions are fine, private keys aren't sent over wifi.

I'm pretty sure most wallets have HD features already, you only need to backup your seeds and you don't need to worry. I'm pretty sure you don't give out your phone randomly to your friends or them uninstalling anything.

I have never needed to upload my proof of identification and just needed to link my bank account. Even though you don't have to do it when creating Bitcoin addresses, most exchanges require users to submit identification for KYC and AML purposes. Most user probably needs that to start using Bitcoin. There's an exception for over the counter trades but it isn't fast and reliable.

No matter how trusted they are, it is centralised and they can say that you violated their TOS and freeze your coins. With desktop wallets, you have the control of your coins and there is no need to worry about it being down. Xapo only insure coins stored in their vaults which means that they won't be held liable for any losses on your normal xapo wallet. If someone manage to gain access to your Xapo account, they can steal all of it.

Bitcoin is safer for the merchant, chargeback is not possible or at least easily achieved and the fees are next to none. For users, if we ignore the freezing of accounts, goods are usually mostly covered under their buyer protection program. The site has to be reputable before I would consider using Bitcoin with them.

Might be wrong on that but it is certainly weird no matter how you see it.

BTCC even though controls only a small portion of the hashrate, they have mined many blocks after OP broadcasted his transaction. Many of the blocks are not even half full, some even at 0.1MB which means that they can still mine OP transaction without difficulty and confirm it. Unless the service has not yet launched or the mining pool hasn't seen it, there is no reason that it is still unconfirmed.

If I understand correctly, your second transaction is from Blockchain.info, going to BTCC. As you said, the network propagation is very low, hence the mining pool might not have even seen your transaction. They may very well be prioritizing their customer's transaction but there is nothing they can do if majority of the nodes do not want to relay it and it won't reach their pool. Most nodes are refusing to relay your transaction as it can't be considered as a free transaction and has a fee below the network relay fee. What they can do is to offer a page for users to directly broadcast raw transactions to the pool.

Yes if you want to avoid the hassle of moving the unsigned transaction back and forth but I wouldn't mind it. You can easily install Armory on a offline raspberry pi and a online computer. Create a unsigned transaction on the online computer and sign it using the offline raspberry pi and transfer it back to broadcast. There is no security risks unless a virus is designed to go into the USB and to the offline raspberry pi and back to the online computer. I highly doubt it would happen since linux itself is quite secure.

Most importantly, it cost only ~50USD compared to 100+USD for trezor.

If you perform a sybil attack and the user uses a SPV client, there's a good chance that you can determine which it originated from. It isn't fully accurate however, anyone can broadcast the transaction from anywhere. The transaction does not state which IP it proporgated from.
Mixers can also keep logs of the IP info and coin origin, you would not be anonymous in anyway.

It is more of a when. Potential activity is gained once per 2 weeks. Hence, User A has more potential activity than post and thus can post to make it appear as activity. User B has more post than potential activity hence he needs to wait till he has more potential activity for it to increase.