Is blockchain.info secure enough?

[zero-asic]

I'm totally new to this and was wondering if blockchain.info is secure enough.  Can I get some opinions on the subject?

[bootmii]

All data is stored on the client side, and the website is protected against server poisoning. In other words, it's secure enough.

[DPony13]

It's great and used for both Pros and Newbs alike


The wallets are client side
but accessed through the website

and uh. yeah :3

[zero-asic]

Thanks!

[DannyHamilton]

I'm totally new to this and was wondering if blockchain.info is secure enough.  Can I get some opinions on the subject?

Secure enough for what?

I probably wouldn't store hundreds of thousands of dollars worth of bitcoin there, but I'd have no problem storing a few hundred dollars worth.

If your computer gets hacked (or you unknowingly download and install a trojan program or virus), it is possible that the malicious program running on your computer could capture your login information and pass it on to someone that could then steal your bitcoin.  It might also be possible for someone to hack the website and feed you a bad copy of the webpage, and as such capture your password.

In general though, assuming your PC is clean and the website hasn't been hacked/modified, it is impossible for anyone working for blockchain.info to steal your bitcoins for their own use unless you provide them with your password or private keys.  As long as you have a copy of your wallet sent to you on a regular basis, you should still be able to recover your bitcoins if blockchain.info were to suddenly disappear.

[Aajo]

Hello, one question regarding e-wallets.
Lets say I made a wallet at blockchain with a few btc and gave the user/pass away to a friend as a present.
Will he be able to see and spend the BTC if the wallet is partly client sided?

[DannyHamilton]

Hello, one question regarding e-wallets.
Lets say I made a wallet at blockchain with a few btc and gave the user/pass away to a friend as a present.
Will he be able to see and spend the BTC if the wallet is partly client sided?

Yes.

Your browser encrypts your private keys client side and then sends the encrypted keys to blockchain.info to be stored in their database. When you log in and try to perform an action that requires access to a private key (such as creating a transaction), your browsers gets the private key from the blockchain.info database, then decrypts it locally using your password.

As long as your friend has the Wallet Identifier and password, they will be able to see and spend the BTC.

[DannyHamilton]

I have been thinking of using Blockchain.info and had a question.

On the site it says you have the option to "backup" your wallet.  What exactly does this mean?  If I backup my wallet, are my bitcoins safe even if Blockchain.info were to just disappear?  Sorry if this question is very newbish.

It means they send you a copy of the encrypted private keys in a file.  As long as you know your password it would be possible to access the private keys in that file and transfer the bitcoin to some other client if blockchain.info were to just disappear.

As for "being safe", you'll have to decide for yourself how likely the following events are that could cause you to lose access to your bitcoin:

• If you lose/forget your password it will be impossible to access the bitcoin
• If a virus or trojan program is installed on your computer, it could capture your password and you could lose your bitcoin
• If you forget to get a backup of your wallet (or lose your backup) after adding a new address, you could lose your bitcoin
• If you generate a new address, and then use that address before it is synchronized from your browser into blockchain.info's database, you could lose your bitcoin

On that last point, take a look at the discussion here:

Just to follow up on this the un-synced warning is now much clearer:

[Aajo]

thanks for the nice explanation, DannyHamilton.