<blockquote>
  <p>What's the difference? Why does only one Web wallet (Coin.Space) give you full control, why not others?</p>
</blockquote>

<p>Click the question mark icon next to each field and it will give you a more detailed explanation of what that qualifier means. For example, "Shared Control over your money" says this:</p>

<blockquote>
  <p>This wallet requires every transaction to be authorized both by you and this third party. Under normal circumstances, you can regain full control over your bitcoins using your initial backup or pre-signed transactions sent by email.</p>
</blockquote>

<p>"Full Control" says this:</p>

<blockquote>
  <p>This wallet gives you full control over your bitcoins. This means no third party can freeze or lose your funds. You are however still responsible for securing and backing up your wallet.</p>
</blockquote>

<hr>

<blockquote>
  <p>Why are these wallets not listed on bitcoin.org/en/choose-your-wallet: StrongCoin, Blockchain.info, Jaxx</p>
</blockquote>

<p>Bitcoin.org has a listing policy for wallets. Wallets must meet certain criteria for security, usability, and privacy in order to be listed on the website. The full criteria is available here: <a href="https://github.com/bitcoin-dot-org/bitcoin.org/blob/master/docs/managing-wallets.md" rel="nofollow noreferrer">https://github.com/bitcoin-dot-org/bitcoin.org/blob/master/docs/managing-wallets.md</a>. Wallets which do not meet those criteria are either not added or are de-listed (as in the case with blockchain.info).</p>

<blockquote>
  <p>Why are these not listed on bitcoin.com/choose-your-wallet: Coin.Space, Xapo</p>
</blockquote>

<p>AFAIK bitcoin.com does not have any criteria for a wallet to be listed. Presumably wallets are not listed there because no one has bothered to ask them to list a wallet.</p>

<hr>

<blockquote>
  <p>Some web wallets (e.g. Coin.Space, Coinbase) say "Vulnerable environment" while others do not (e.g. BitGo, BTC.com). Some like Jaxx list "Secure environment". What is the difference?</p>
</blockquote>

<p>Again, clicking the question mark icon will tell you. For "Vulnerable Environment", it says:</p>

<blockquote>
  <p>This wallet can be loaded on computers which are vulnerable to malware. Securing your computer, using a strong passphrase, moving most of your funds to cold storage, or enabling two-factor authentication can make it harder to steal your bitcoins.</p>
</blockquote>

<p>For "Secure Environment":</p>

<blockquote>
  <p>This wallet is loaded on mobiles where apps are usually isolated. This provides a good protection against malware, although mobiles are usually easier to steal or lose. Encrypting your mobile and backing up your wallet can reduce that risk.</p>
</blockquote>

<hr>

<blockquote>
  <p>Some says "Remote app", some do not. What is the difference?</p>
</blockquote>

<p>For "Remote App":</p>

<blockquote>
  <p>This wallet is loaded from a remote location. This means that whenever you use your wallet, you need to trust the developers not to steal or lose your bitcoins in an incident on their site. Using a browser extension or mobile app, if available, can reduce that risk.</p>
</blockquote>

<hr>

<blockquote>
  <p>It appears that their recovery would be more troublesome compared to a mnemonic phrase method. Especially, the mention of "nLocktime" by GA was lost on me.</p>
</blockquote>

<p>It can be more secure because in order for someone to steal your Bitcoin, they would need to compromise more than just your mnemonic, they would also need to compromise whatever two factor authentication you have set up in order to spend your coins.</p>

<p>The nLockTime thing is a special transaction which cannot be confirmed until after a certain date or block height. This transaction is for the possibility that GreenAddress becomes unavailable for some reason but still allows you to access your money.</p>

<blockquote>
  <p>About your comment: "can easily be stolen by the wallet provider". Is it because they know the mnemonic phrase? Is it that they generate it so they know it?</p>
</blockquote>

<p>No, it is because you are using whatever web wallet software they serve to you at the time you visit their website. You have absolutely no control over what software you are actually using (as in what the code is). So that software could be malicious, and there would be nothing you could do about it. For example, suppose blockchain.info has been legally obligated to confiscate your coins. They could simply just serve you and only you a modified version of their software which sends all of your private keys back to them in an unencrypted form and all transactions that that software makes just sends the coins back to blockchain.info. This does not even have to be blockchain.info being malicious; it could be a man-in-the-middle attacker who has hijacked your connection to blockchain.info and served you the bad software.</p>

CC BY-SA 3.0
2017-08-30T23:18:18.550Z
Thank you!! After several hours of searching/reading, I'm getting "some" understanding. One thing is still not clear, on the bitcoin.org page, why does only coin.space web wallet say "full control over your bitcoins". Is it unique from the rest? (I've read one should only choose a wallet that gives full control).
kayan1
CC BY-SA 3.0
2017-08-31T00:08:44.990Z
Because with coin.space you can spend your coins without any involvement from coin.space. The other wallets use multisig where the wallet provider holds 1 signing key for all of your addresses so that you use a 2fa thing for it. It looks like coin.space is like blockchain.info where you have full control over your private keys in theory, but they can easily be stolen by the wallet provider.
Ava Chow
CC BY-SA 3.0
2017-08-31T04:48:34.897Z
Andrew, thanks for being so helpful. I really respect that. After spending several hours today reading stuff and bugging you, I'm starting to get "some" idea about HD and multi-sig concepts :) Thanks for clarifying.
kayan1
CC BY-SA 3.0
2017-08-31T04:55:47.030Z
1. After reading about HD, BIP and understanding (somewhat) how blockchain.info's (bc.i) recovery works, I looked at a few multi-sig wallets briefly: BTC.com, BitGo, GreenAddress (GA). It appears that their recovery would be more troublesome compared to a mnemonic phrase method. Especially, the mention of "nLocktime" by GA was lost on me. I'd love your thoughts/feedback please.
kayan1
CC BY-SA 3.0
2017-08-31T05:06:12.863Z
2. About your comment: "can easily be stolen by the wallet provider". Is it because they know the mnemonic phrase? Is it that they generate it so they know it? If so, would you please recommend a wallet that gives full control of key and is easy to recover? I suspect with multi-sig, one would be dependent on pre-signed transactions being sent (by the wallet company), which may not happens if it suddenly disappears. Please correct me if I've completely misunderstood things.
kayan1
CC BY-SA 3.0
2017-08-31T17:50:29.450Z
Thanks for answering my questions. It's very nice of you, it's a pleasure to read your excellent explanations. What you wrote about the online code being changed in regards to bc.i or man-in-the-middle, is the Electrum wallet susceptible to this also? Could you recommend a safe wallet based on your experience? I'm currently looking into Electrum, BitGo, BTC.com wallets .. but I'm not knowledgeable enough. Thanks.
kayan1
CC BY-SA 3.0
2017-08-31T17:52:35.947Z
Electrum is not susceptible to this. Nor is any desktop wallet where you download and install the wallet software locally. Desktop wallet software like Electrum also usually have instructions for verifying that the download is legitimate and was non MITM'd
Ava Chow
CC BY-SA 3.0
2017-09-01T17:02:45.940Z
Andrew, thank you. I guess one last question on this. When I get the 12 word backup phrase for a new HD wallet, any way to encrypt it? (Possibly into another 12 word phrase that I can then decrypt back?). I'm asking in case I write my 12 word phrase somewhere and it gets stolen. If it's encrypted by a password (in my mind), it might offer some protection. (I know Strongcoin wallet (which I think is non-HD) does something similar for the private key, where they give you a backup PDF with encrypted version of private key, using openssl aes.)
kayan1
CC BY-SA 3.0
2017-09-01T19:40:43.327Z
AFAIK BIP 39 (the standard for mnemonics) does not have anything for encrypting mnemonics. However there is nothing preventing you from encrypting it yourself with some other software. It just means that you can't plug it into a wallet and expect the wallet to be able to know what to do with your encrypted mnemonic.
Ava Chow
CC BY-SA 3.0
2017-09-01T20:27:40.683Z
Can you please suggest an easy way to encrypt the phrase and get it back in the same order (on Windows)? I'm not familiar with encryption much. (I do understand I'll have to decrypt it before using to recover a wallet). Thanks Andrew.
kayan1
CC BY-SA 3.0
2017-09-02T15:34:15.797Z
You can use GPG to encrypt it.
Ava Chow
CC BY-SA 3.0
2017-09-02T21:19:13.737Z
Thank you my friend. You are incredibly helpful and an asset to this website, really! Is there a way to send a PM/email to you? Thanks.
kayan1
CC BY-SA 3.0
2017-09-13T19:19:00.737Z
Hi Andrew, what are your thoughts on myetherwallet vs. blockchain.info for storing ETH? Thank you.
kayan1
CC BY-SA 3.0
2017-08-30T23:04:41.567Z
2017-08-31T14:25:45.817Z
2017-08-31T14:25:45.817Z
Ava Chow
<p>I have some questions about the listed Web wallets. Can someone please help me understand?</p>

<ol>
<li>The bitcoin.org page for some web wallets says "Shared control over your money" (e.g. BitGo, BTC.com) while for Coin.Space says "Full control"</li>
</ol>

<p>What's the difference?
Why does only one Web wallet (Coin.Space) give you full control, why not others?</p>

<p>2.</p>

<p>Why are these wallets not listed on bitcoin.org/en/choose-your-wallet:
StrongCoin, 
Blockchain.info,
Jaxx</p>

<p>Why are these not listed on bitcoin.com/choose-your-wallet:
Coin.Space,
Xapo</p>

<ol start="3">
<li><p>Some web wallets (e.g. Coin.Space, Coinbase) say "Vulnerable environment" while others do not 
(e.g. BitGo, BTC.com). Some like Jaxx list "Secure environment". 
What is the difference?</p></li>
<li><p>Some says "Remote app", some do not. 
What is the difference?</p></li>
</ol>

<p>I’d be thankful for your help!</p>

<hr>

<p>Additional Questions (from comments):</p>

<ol>
<li><p>After reading about HD, BIP and understanding (somewhat) how blockchain.info's (bc.i) recovery works, I looked at a few multi-sig wallets briefly: BTC.com, BitGo, GreenAddress (GA). It appears that their recovery would be more troublesome compared to a mnemonic phrase method. Especially, the mention of "nLocktime" by GA was lost on me. I'd love your thoughts/feedback please.</p></li>
<li><p>About your comment: "can easily be stolen by the wallet provider". Is it because they know the mnemonic phrase? Is it that they generate it so they know it? If so, would you please recommend a wallet that is not easily stolen, but gives full control of key and easy to recover? I suspect with multi-sig, one would be dependent on pre-signed transactions being sent (by the wallet company), which may not happens if it suddenly disappears. Please correct me if I've completely misunderstood things.</p></li>
</ol>

<bitcoin-core><client><buy-bitcoins><bitcoin-core-development>
Web Wallet difference
kayan1
# Web Wallet difference

(Asked by: username_0 on 2017-08-29)

I have some questions about the listed Web wallets. Can someone please help me understand?

1. The bitcoin.org page for some web wallets says "Shared control over your money" (e.g. BitGo, BTC.com) while for Coin.Space says "Full control"

What's the difference?
Why does only one Web wallet (Coin.Space) give you full control, why not others?

2.

Why are these wallets not listed on bitcoin.org/en/choose-your-wallet:
StrongCoin,
Blockchain.info,
Jaxx

Why are these not listed on bitcoin.com/choose-your-wallet:
Coin.Space,
Xapo

3. Some web wallets (e.g. Coin.Space, Coinbase) say "Vulnerable environment" while others do not
   (e.g. BitGo, BTC.com). Some like Jaxx list "Secure environment".
   What is the difference?
4. Some says "Remote app", some do not.
   What is the difference?

I’d be thankful for your help!

---

Additional Questions (from comments):

1. After reading about HD, BIP and understanding (somewhat) how blockchain.info's (bc.i) recovery works, I looked at a few multi-sig wallets briefly: BTC.com, BitGo, GreenAddress (GA). It appears that their recovery would be more troublesome compared to a mnemonic phrase method. Especially, the mention of "nLocktime" by GA was lost on me. I'd love your thoughts/feedback please.
2. About your comment: "can easily be stolen by the wallet provider". Is it because they know the mnemonic phrase? Is it that they generate it so they know it? If so, would you please recommend a wallet that is not easily stolen, but gives full control of key and easy to recover? I suspect with multi-sig, one would be dependent on pre-signed transactions being sent (by the wallet company), which may not happens if it suddenly disappears. Please correct me if I've completely misunderstood things.

**Tags:** bitcoin-core, client, buy-bitcoins, bitcoin-core-development


---

## 1 answers

### Answer by username_1 on 2017-08-30. Score: 1 | Accepted answer

> What's the difference? Why does only one Web wallet (Coin.Space) give you full control, why not others?

Click the question mark icon next to each field and it will give you a more detailed explanation of what that qualifier means. For example, "Shared Control over your money" says this:

> This wallet requires every transaction to be authorized both by you and this third party. Under normal circumstances, you can regain full control over your bitcoins using your initial backup or pre-signed transactions sent by email.

"Full Control" says this:

> This wallet gives you full control over your bitcoins. This means no third party can freeze or lose your funds. You are however still responsible for securing and backing up your wallet.

---

> Why are these wallets not listed on bitcoin.org/en/choose-your-wallet: StrongCoin, Blockchain.info, Jaxx

Bitcoin.org has a listing policy for wallets. Wallets must meet certain criteria for security, usability, and privacy in order to be listed on the website. The full criteria is available here: <https://github.com/bitcoin-dot-org/bitcoin.org/blob/master/docs/managing-wallets.md>. Wallets which do not meet those criteria are either not added or are de-listed (as in the case with blockchain.info).

> Why are these not listed on bitcoin.com/choose-your-wallet: Coin.Space, Xapo

AFAIK bitcoin.com does not have any criteria for a wallet to be listed. Presumably wallets are not listed there because no one has bothered to ask them to list a wallet.

---

> Some web wallets (e.g. Coin.Space, Coinbase) say "Vulnerable environment" while others do not (e.g. BitGo, BTC.com). Some like Jaxx list "Secure environment". What is the difference?

Again, clicking the question mark icon will tell you. For "Vulnerable Environment", it says:

> This wallet can be loaded on computers which are vulnerable to malware. Securing your computer, using a strong passphrase, moving most of your funds to cold storage, or enabling two-factor authentication can make it harder to steal your bitcoins.

For "Secure Environment":

> This wallet is loaded on mobiles where apps are usually isolated. This provides a good protection against malware, although mobiles are usually easier to steal or lose. Encrypting your mobile and backing up your wallet can reduce that risk.

---

> Some says "Remote app", some do not. What is the difference?

For "Remote App":

> This wallet is loaded from a remote location. This means that whenever you use your wallet, you need to trust the developers not to steal or lose your bitcoins in an incident on their site. Using a browser extension or mobile app, if available, can reduce that risk.

---

> It appears that their recovery would be more troublesome compared to a mnemonic phrase method. Especially, the mention of "nLocktime" by GA was lost on me.

It can be more secure because in order for someone to steal your Bitcoin, they would need to compromise more than just your mnemonic, they would also need to compromise whatever two factor authentication you have set up in order to spend your coins.

The nLockTime thing is a special transaction which cannot be confirmed until after a certain date or block height. This transaction is for the possibility that GreenAddress becomes unavailable for some reason but still allows you to access your money.

> About your comment: "can easily be stolen by the wallet provider". Is it because they know the mnemonic phrase? Is it that they generate it so they know it?

No, it is because you are using whatever web wallet software they serve to you at the time you visit their website. You have absolutely no control over what software you are actually using (as in what the code is). So that software could be malicious, and there would be nothing you could do about it. For example, suppose blockchain.info has been legally obligated to confiscate your coins. They could simply just serve you and only you a modified version of their software which sends all of your private keys back to them in an unencrypted form and all transactions that that software makes just sends the coins back to blockchain.info. This does not even have to be blockchain.info being malicious; it could be a man-in-the-middle attacker who has hijacked your connection to blockchain.info and served you the bad software.

> **Comments:**
> **username_0**: Thank you!! After several hours of searching/reading, I'm getting "some" understanding. One thing is still not clear, on the bitcoin.org page, why does only coin.space web wallet say "full control over your bitcoins". Is it unique from the rest? (I've read one should only choose a wallet that gives full control).  
> **username_1**: Because with coin.space you can spend your coins without any involvement from coin.space. The other wallets use multisig where the wallet provider holds 1 signing key for all of your addresses so that you use a 2fa thing for it. It looks like coin.space is like blockchain.info where you have full control over your private keys in theory, but they can easily be stolen by the wallet provider.  
> **username_0**: Andrew, thanks for being so helpful. I really respect that. After spending several hours today reading stuff and bugging you, I'm starting to get "some" idea about HD and multi-sig concepts :) Thanks for clarifying.  
> **username_0**: 1. After reading about HD, BIP and understanding (somewhat) how blockchain.info's (bc.i) recovery works, I looked at a few multi-sig wallets briefly: BTC.com, BitGo, GreenAddress (GA). It appears that their recovery would be more troublesome compared to a mnemonic phrase method. Especially, the mention of "nLocktime" by GA was lost on me. I'd love your thoughts/feedback please.  
> **username_0**: 2. About your comment: "can easily be stolen by the wallet provider". Is it because they know the mnemonic phrase? Is it that they generate it so they know it? If so, would you please recommend a wallet that gives full control of key and is easy to recover? I suspect with multi-sig, one would be dependent on pre-signed transactions being sent (by the wallet company), which may not happens if it suddenly disappears. Please correct me if I've completely misunderstood things.  
> **username_0**: Thanks for answering my questions. It's very nice of you, it's a pleasure to read your excellent explanations. What you wrote about the online code being changed in regards to bc.i or man-in-the-middle, is the Electrum wallet susceptible to this also? Could you recommend a safe wallet based on your experience? I'm currently looking into Electrum, BitGo, BTC.com wallets .. but I'm not knowledgeable enough. Thanks.  
> **username_1**: Electrum is not susceptible to this. Nor is any desktop wallet where you download and install the wallet software locally. Desktop wallet software like Electrum also usually have instructions for verifying that the download is legitimate and was non MITM'd  
> **username_0**: Andrew, thank you. I guess one last question on this. When I get the 12 word backup phrase for a new HD wallet, any way to encrypt it? (Possibly into another 12 word phrase that I can then decrypt back?). I'm asking in case I write my 12 word phrase somewhere and it gets stolen. If it's encrypted by a password (in my mind), it might offer some protection. (I know Strongcoin wallet (which I think is non-HD) does something similar for the private key, where they give you a backup PDF with encrypted version of private key, using openssl aes.)  
> **username_1**: AFAIK BIP 39 (the standard for mnemonics) does not have anything for encrypting mnemonics. However there is nothing preventing you from encrypting it yourself with some other software. It just means that you can't plug it into a wallet and expect the wallet to be able to know what to do with your encrypted mnemonic.  
> **username_0**: Can you please suggest an easy way to encrypt the phrase and get it back in the same order (on Windows)? I'm not familiar with encryption much. (I do understand I'll have to decrypt it before using to recover a wallet). Thanks Andrew.  
> **username_1**: You can use GPG to encrypt it.  
> **username_0**: Thank you my friend. You are incredibly helpful and an asset to this website, really! Is there a way to send a PM/email to you? Thanks.  
> **username_0**: Hi Andrew, what are your thoughts on myetherwallet vs. blockchain.info for storing ETH? Thank you.  

---

