It's pretty terrible advice to tell non-technical users to manage their own wallet. Keeping it secure is a non-trivial (understatement!) task.

It certainly was, until the advent of hardware wallets. I wouldn't quite say its easy enough for Grandma to do it, but it makes things much more secure and its no more complicated than setting up a wallet on your machine (give or take a couple of steps).

I just went through the situation where a family member all of sudden panicked (1 week after I reiterated all disclaimers multiple times, I said BTC is stretched and he already missed all forks that may solve it, etc, etc) and wanted his BTC paper wallet transferred to anything else. 33 hours later and 2 times > 40 euros (> 600 Satoshi/Byte) of transfer cost later the BTC are now USD in Bittrex.

Never advice your family anything. If they don't get it, they shouldn't be playing with it. This was certainly my last time, I even think I'm flat out going to refuse to talk about anymore. This week I even received texts that I should act "before Amerika wakes up". It's stopping right now, he either learns the Gdax or I will transfer what's left of his money to his normal bank account (he should be happy it's still almost everything.)

I vehemently advise everyone to stay away from BTC unless you really, really know what you're doing and follow the market closely. Instead, I say to just find a small, cheap crypto that has sound fundamentals and go from there. There aren't many, but they exist.

Indeed. the operational risk is huge. even for tech savvy participants

What kind of non-technical person is trying to buy and manage a bitcoin wallet in the first place?

If the user is only willing to learn enough to keep the coins in Coinbase, then this person has no business dealing with Bitcoin at all.

> What kind of non-technical person is trying to buy and manage a bitcoin wallet in the first place?

I've had half a dozen non-technical friends ask me about getting into Bitcoin in the last month or so. Media attention, get-rich-quick, scams, etc. are all attracting hordes of people, to the point where the Coinbase app was #1 on the App Store for a while.

Even the people running exchanges are getting hacked. What chance does a normal user have?

> Even the people running exchanges are getting hacked. What chance does a normal user have?

I agree that actually securing a wallet, independently, as a non-technical user, is difficult. It is further exacerbated by, as you mentioned, the general hype around crypto related apps that promise to do this in a trivial way, which can often be traps.

I also, however, think your final question presents a false dichotomy, as the two (Exchanges and users) have different threat models.

Exchanges present a larger, highly lucrative target, meaning they are ammenable to expensive, targeted attacks as they can still be possible.

The security model for an individual user can be to secure their coins in a way that is relatively secure (Maybe not as absolutely, as they are not experts), but more importantly to secure their coins in a way which a scalable attack against many users is not tenable.

In this way, just because exchanges get hacked doesn’t necessarily imply that normal users don’t have a chance, as they have different threat models with their own nuances.

Edit: Cleaned up some wording

Ah man I had the same, how did you handle it? I regret helping anyone now, it was stressful and they underestimated the risk despite my constant nagging. Last week in BTC land was insane.

My stock response is "treat it as gambling - put in only what you can afford to completely lose, because I feel like it's a massive bubble, but it's impossible to predict when it might pop".

> If the user is only willing to learn enough to keep the coins in Coinbase, then this person has no business dealing with Bitcoin at all.

"It's the financial system of the future!"

"Only techies can use it!"

Pick one.

By 1950s standards, most Americans are "techies". We learn what we have to in order to survive in a given environment.

We use more technology, but we understand less about what makes it tick. Most of today's Americans can't change a flat tire, let alone the oil. 1950s America would laugh at us for that.

Someone's ability to use a smartphone doesn't mean they're capable of patching the thing to keep it secure.

You're comparing coinbase to an idealised version of a private wallet–which doesn't exist. In reality, a lot of money was probably lost to hard drive failures and other human errors. We just never read about it in the news, because each individual case is too small to warrant news coverage.

There are several reputable apps for both iOS and Android that provide secure, easy to use wallets, which do not centralize the storage of a user's coins whatsoever.

I've told friends for years about Bread[0], a wallet app for both smartphone platforms that I've used before with great success.

[0] https://breadapp.com/

That's just changing the threat from "compromised exchange" to "compromised phone". I'd trust Coinbase to get it right before I'd trust the average Android phone not to be hacked.

Only 0.5% of Android devices are running the latest OS. https://developer.android.com/about/dashboards/index.html#

What are you talking about? This is not about the exchange being compromised at all. In any event, I don't think it's much more difficult to get your phone getting hacked than it is to get your Coinbase account hacked. That's not what this is about.

This is about the cloud wallet service provider having the ability to basically do whatever it wants with your funds (including using them to pad their fractional reserves), charge you whatever fees it wants for whatever dumb reason they can think of, and do all the other things the banking system does today to peoples' wealth.

If this is what you want to do with your Bitcoin, then you're better off putting your money into fiat because that's a system that was actually designed to be used in our current currency/banking scheme.

> What are you talking about? This is not about the exchange being compromised at all.

Yes, it is. The question is "which place to store your coins is riskier?" I'm of the opinion that a decently run exchange with a full security team in place is going to be better at managing security than virtually any individual attempting to do it at home.

You, for example, suggested an Android app as a wallet, which seems to conflict with the best practice of storing wallets on an air-gapped offline system or on a dedicated hardware device.

> The question is "which place to store your coins is riskier?"

Where did you get that idea from? Not from my OP, that's for sure:

> One of Bitcoin's selling points is that it's decentralized. By keeping coins in a cloud operated wallet that you don't fully control, you're willfully giving up control over your own wealth, and needlessly putting your coins at risk.

Please, do not misrepresent my views. I do not have much of an opinion on the security of wallets, because I know that unless you go cold storage, any other wallet approach is about as safe as the one in your back pocket.

You can't seem to stop injecting your own totally unrelated arguments and also seem to refuse to actually comprehend the complaint I aired in my OP.

The concern I raised was one of centralization. The Bitcoin white paper is pretty explicit when it comes to explaining its rationale, and in fact mentions negating centralization in the very first sentence of the abstract[0]:

> A purely peer-to-peer version of electronic cash would allow online payments to be sent directly from one party to another without going through a financial institution.

[0]https://bitcoin.org/bitcoin.pdf

So there's really no reason to continue to ignore what I am actually saying, because it's a valid concern that strikes at the core tenants of Bitcoin's intended use case. Your concern, on the other hand, is splitting hairs on a subject that does not at all address the actual, fundamental issue of using a Coinbase wallet. This has nothing to do with Coinbase the exchange, this is about the Coinbase service which offers wallets, to which they and only they control the private key.

> needlessly putting your coins at risk

You keep claiming I'm misreading you, but this is the precise bit I'm focused on. For most people, and non-technical folks in particular, storing their own Bitcoin is "needlessly putting your coins at risk". They'd be better off having it on Coinbase and letting their security folks handle the risk.

I couldn't care less about the decentralization aspect of the argument, as none of that matters as a user if my coins all got stolen off my phone. It's already quite clear that Bitcoin is moving towards more centralization with stuff like the Lightning network, as the fully decentralized approach is already creaking under the current load.

When you put US Dollars in your wallet and then put the wallet in your back pocket, you are putting those dollars at risk. This is the same basic risk you take when you put Bitcoin in a decentralized wallet that you fully own.

However, the point you keep missing is the needless part.

This is not needless risk - this is a calculated risk, which you take based upon the fact that it will make access and use of those bills easier than if you didn't take your cash with you when you went out. If you use common sense, you can still be reasonably sure that your wallet will remain with you and will not have any money stolen out of it.

I've lived in New York City since the crack epidemic, and not once has this strategy failed me, but I do knowingly walk around the street with the knowledge that a crafty pickpocket could probably get away with my wallet if they really wanted to. But with my success rate, it looks like my strategy is paying off, and this is an important thing to judge because money is an important component to one's survival.

Let's look at the benefits of not placing your Bitcoin in a centralized wallet which you do not control. The benefit is that you have access to your coins, can move them however you'd like, and pay whatever fee structure you want. Coinbase only offers you the former. By not storing your wallet on a centralized service, your money is not at the whim of that centralized service. That's a HUGE gain. That's the crux of bitcoin's value.

Leaving your bitcoin in the hands of Coinbase is needless risk because your coins are just as accessible and just as easy to steal from Coinbase as they are to steal from any other wallet accessible via the internet. The added risk Coinbase presents is that they control your funds, they own the private keys, and they dictate all the rules for storing and moving your money. Not to mention, they don't give you freedom from the world financial institutions, they make you an ever-larger cog in the wheel of the current financial system. Why the hell would you want that? If you would actually want that, buy some Swiss Francs or some other fiat currency and stop speculating in Bitcoin.

This flies in the face of the entire purpose of having Bitcoin. If you remove decentralization from Bitcoin, then you remove Bitcoin's power and value. So the people who would prefer to not store their Bitcoin in cold storage should not be getting heavily invested in it. If they have real money on the line that could be ruinous to lose, then they should learn how to be a responsible patron of Bitcoin. Any less would be downright irresponsible.

If this is actually a problem for anyone investing serious money into Bitcoin, then they should stop investing in Bitcoin and figure out something else to do with their time. This is not a plaything, this is cash and people who want to invest in it need to do so responsibly. All this reckless behavior being espoused in threads like these all across the internet are just asking for huge, overbearing regulation of the cryptocurrency industry. Watch it flounder and suffer as a result.

I could personally care less. I sold off the 224 Bitcoins I acquired back in 2008 a few days ago and fed the mania. I refuse to participate in this financial moshpit and I will not contribute to this nonsense any further.

> Leaving your bitcoin in the hands of Coinbase is needless risk because your coins are just as accessible and just as easy to steal from Coinbase as they are to steal from any other wallet accessible via the internet.

This is so transparently false.

Coinbase has a security team that I lack. They have experts in the field that I lack. They have insurance for their holdings that I lack. They have the infrastructure and knowledge to keep cold wallets secure that I lack. None of these lacks can be easily remedied by an individual like me.

They have no ability to use my coins at their "whim". They're a US corporation in a heavily regulated space, money transmission, subject to a whole bunch of laws, both state and Federal. I have far more recourse against them than someone who puts a keylogger on my phone and siphons off my holdings.

It’s all about opportunity, risk and reward. Hack a phone and you win some bitcoins. Quickly patched. Hack an exchange and you’re rich beyond belief.

You've left out "use an existing Android botnet to siphon off private keys in a way that's far less likely to attract law enforcement attention".