Coinbase is definitely the easiest way to buy bitcoins with USD. If you do use them though, just be sure to avoid turning on the API key accidentally. I read a Coindesk article a while ago about a significant amount of money being stolen from a Coinbase user's account because he accidentally turned this on and some hacker got access. It was like $7,000 if I remember correctly. Happened twice: they reimbursed him the first time, but not the second time. For the most part, I really like Coinbase, but I do think they made the wrong call by not reimbursing him both times since it was an issue with their own API key not being secure enough.
The easiest way to avoid unwanted access is to obviously enable 2 factor authentication, don't allow other apps access to coinbase, and frequently check to make sure that the browser that you are using is the only active session logged in. If you have left it logged in by mistake..then log out of all other active sessions.
I absolutely agree with you on 2 factor authentication, I have that enabled on my Coinbase and I'll never turn it off. It's just a no brainer. But it won't help at all if you accidentally turn on the API key, that bypasses 2 factor altogether. I suppose that does fall into what you said about not allowing other apps to access Coinbase though. It does make me question their security for businesses though; I would think you'd need that API key if you were going to base a website's code off Coinbase.
It has me thinking that if I ever setup the bitcoin based business that I'm thinking of, I might just use the Armory API instead of bitcoin. If I can do it without using their API key, I still would, but after reading that story, I'd be pretty reluctant to turn it on, as that's a pretty substantial amount of money to lose to hackers.
