Summary

Blockchain.info set the bar for security in the bitcoin wallet industry for many years, but has fallen behind newer wallets that have been quicker to integrate new innovations in the market.

Still, blockchain remains the most popular stand-alone wallet service online, with over 1 million users, and with a recent fundraising round raising $30.5 million, blockchain is sure to maintain it’s position as one of the most popular wallets in the bitcoin market.

The blockchain Wallet

Wallets are encrypted client-side using random number generation, and only the encrypted wallet is stored on the blockchain server. Passwords to unencrypt the wallet and approve transactions are held by the user and are unknown by blockchain.info. Blockchain offers passphrases for password retrieval, 16 and 6 words for first and second passwords respectively, but if a password is lost and the user has not recorded the passphrases, a client’s wallet is effectively locked forever.

Random number private key generation allows one private key per address. Multiple addresses can be generated, but each address brings with it a new private key. If you plan to utilize a number of addresses, for bookkeeping and such, this makes the backing up process a much more cumbersome task as old backups will not have any record of newly generated addresses. Automatic encrypted backups can be sent from blockchain info to email or dropbox after every new address is set. Paper wallets would need to be regenerated. So it is manageable, but not the most convenient solution in the market.

There are a number of security features aiming to limit client side and server side breach risk.
Entering the account requires two-factor authentication, and PBKDF2, a function which stretches passwords to prevent brute force attacks, is available in 5000 increments up to 20,000. Basically, this increases the computational effort required to crack a password accordingly. Users are also able to set up a an IP whitelist, allowing transactions to be made only from included IPs.

Offline Wallet

There is an option to create a watching-only wallet, or a wallet with no corresponding online private key. This means that while coin can be sent to the wallet, transactions only can be authorized from a paper wallet. blockchain calls this “cold storage”, but security experts would most likely disagree for two reasons.

First, the paper wallet must be generated online. Recently, it was discovered that the unencrypted private key associated with the paper wallet was actually stored in the browser history. What a massive hole for hackers to exploit. As of February 2015, this has not been addressed by blockchain.

Secondly, for transactions to be signed by the paper wallet, the QR code must be scanned on the connected computer – severing the total disconnect between on and offline systems. The most security minded among you would most likely want to generate a new address and new corresponding paper wallet after each transaction.

However for most, this is a sufficient solution.

Mobile

blockchain has very good ios and android apps, which are easily paired to the desktop account by scanning a QR code which is kept behind a user password. Once the mobile is paired, the wallet can be accessed simply by entering a four digit pin, and most important features – like sending and receiving funds, are available in app.

Bottom line

Blockchain has been around for years now, and is the most popular wallet in the market. However, it has not kept up with security trends and this has led, as of late, to a number of small security breaches resulting in lost coin. A number of user-friendly functionalities, like HD for instance, are missing from blockchain.info. Blockchain is useful for on-the-go mobile bitcoin needs, but there are other more convenient and perhaps safer options for storing coin.