Wallet encryption isn't any help against keyloggers and other local malware that can observe your use of the wallet. And wallet encryption simple enough for average folks — a short passphrase of their own choosing - is easy for digital pickpockets to crack.
Since Bitcoin miners have awesome GPUs, malware could use the victim's own GPU to crack their wallet. (And then go back to mining... for the malware owner.)
I have to imagine it's a lot easier to write a program that looks for a wallet.dat on my machine and mails it somewhere than it is to follow my steps into my bank account and transfer money.
It's the difference between having cash stolen from under your mattress and someone stealing your credit card.
I had someone make a fake debit card matching my account number. It didn't have my PIN, the number on the back, or my name on it, but it had my 16 digit number. That is something you can just create randomly, from the perspective of the customer there is absolutely nothing you can do to protect yourself from that. I guess they generate a bunch and test them somehow, but since the thief had a card that matched an account, he went out and tried about 9 stores in an hour. He was able to buy about $1200 in merchandise from 2 stores, the rest either rejected him or by that point the bank had declined my account.
The bank called me and told me all of this within 20 minutes of it happening. I saw the money debited from my account, my bank balance was lower, etc. They sent me 2 forms to sign saying it wasn't me, and within 24 hours the money was back in my account. Since then the bank has dealt with the merchants who took the fake card, filed a fraud report, etc. I spent less than 20 minutes dealing with this overall, it was not a big deal for me.
Contrast that with someone stealing $1200 from my safe or $1200 of my bitcoins. I'm just screwed then. I have no recourse, no one dealing with this stuff for me, etc.
While keeping your login information secure is a good thing, ultimately the banks are the ones keeping things secure. They have plenty of intelligent systems that know your typical buying habits, and you are quickly red flagged when some unusual purchases happen.
I know that transferring money out of my bank accounts over the internet at my bank REQUIRES a phone call and a piece of paper the first time. After that, sure, you can transfer instantly. But if someone installs a keylogger on my machine and transfer all the money from my checking account to my savings account or my investments, I don't really care. I'll just transfer it back. He will not be able to transfer it to his own bank account very easily, not unless he breaks the banks system. And as shown by the debit card incidident, when the bank's security fails the customer is not liable.
Well said! The ability to handle fraud in this manner has a big picture effect as well.
Banks are powerful. They can do things that you and I can't. If a bank transfers money as part of a fraudulent transfer, it can reverse that transfer electronically. This reversal traverses the banking system all the way back to the entity that accepted the payment.
This system diffuses the impact of fraudulent transfers and places the ultimate responsibility on those accepting payment, rather than those holding currency. I know that sounds harsh, but the person accepting the payment probably has the best chance of detecting a fraud. Without this check & balance, there's very little incentive for merchants to verify the validity of the funds being used.
What about your passwords to your real-life bank accounts?
Your bank has ways to make that more secure. If someone logs into your account from a strange IP (e.g. different country from the bank and customer), if someone tries to transfer money online, you might need to enter another password (which they might not have), or it might be based on a fob that generates a code. If you do manage to transfer money to your account, they can now follow the money to find out where you are and arrest you.
BitCoin stealing doesn't have any of these drawbacks, so is probably a much more tempting target.
If I might ask, and I'd be happy to take this discussion elsewhere... but why? For that much money and the risk associated, surely as an investment vehicle?
Bank accounts usually limit online transfer destinations and amounts. So password secrecy is not the sole defense, and even total ownership of an accountholder's computer is not quite 'game over' for their balances, as it is with a bitcoin wallet.
