What is the difference between storing ether with an exchange (e.g. Coinbase, Kraken, Gemini, Poloniex, Bittrex) and a wallet like Jaxx, MEW, MetaMask?
Add a comment
|
2 Answers
Your ETH & tokens are on the blockchain, regardless of what service you use to access them. When you move them, you are sending them from one address on the blockchain to another. These are simply lines of code. Your wallet file, the user interface you interact with, the private key—these do not have funds in them. The private key gives you the ability to prove ownership over coins that are on the blockchain.
If you use a client-side tool like MyEtherWallet or Mist, Metamask, Exodus, or Jaxx, then you have the private key & you control your funds and your key. You do not rely on Coinbase or Gemini sending your funds from their account to yours.
The upside is that you, and only you, control your keys. An exchange getting hacked won't affect you. The downside is that you, and only you, control your keys. No one else has them, nor can recover them, should you lose them.
If you do lose your private key or wallet file or password, you cannot prove ownership of an account and therefore you cannot ever send your coins again.
If you use an exchange like Coinbase, Gemini, Kraken, Polonix, Bittrex, then you have any account with that company, and they hold your ETH and your keys for you. They have their own account on the blockchain with all their and their customers' funds in it. Then you have a username / password with them, on their servers, and they keep track of how much ETH they "owe" you.
This allows you to have the more traditional username / password situation and do things like reset your password if you forget it, change your password if your password is compromised, and turn on 2FA. However, it also means that if the exchange loses ETH, it's your ETH that is lost.
If you choose to move from an exchange to a wallet where you control your keys, you need to make sure that you have multiple backups, stored in separate locations, of your private key + password. This will prevent loss in case your computer crashes or your house burns down or anything else.
You also need to ensure you keep these keys securely. This means:
- Don't enter it on random websites
- Always ensure you are on the correct site or downloading from the legitimate repo / website.
- Don't email your key, send it to anyone or post it online
- Don't save it to cloud storage
- Don't have Team Viewer or other remote access software on your computer
If this seems very overwhelming, an option would be to purchase a Ledger or TREZOR hardware wallet. These help keep your keys safe and stored in an "offline" device, rather than on your computer. In this case, you don't have to worry about files or strings of characters; instead you just connect your hardware wallet to your computer.
-
If you use an exchange, you're also at the exchange's mercy when it comes to tokens and forks. Also, some wallets enable the use of contracts for storing ether; this gives rise to the possibility of things like multi-sig wallets and deadman switches.– lungjCommented Aug 5, 2017 at 5:05
An exchange is akin to a stock market exchange. It is a platform on which you can buy or sell Ether. Some offer more complex functionality like margin trading with leverage. Examples include Kraken and Coinbase.
A wallet is akin to a.. wallet. In the real world you have a wallet which you put your cash, and cards in. Sometimes you will put your identity card and driving license into your wallet too. An Ethereum wallet is simply a digital version of the same concept it holds your Ether, and can be used to identify you.
Further explanation of wallets is outlined here. On a technical level a wallet (synonymous with Ethereum address) is a 40 character hex encoded string.
Going back to the real world comparisons, an Ethereum wallet is like a see-through safe - you can see what is in it, but you can not do anything with those contents unless you have a key. An Ethereum address is derived from a public key which has a matching private key. It is the private key which gives you control over the contents of the address, and is thus the thing that you must protect.
Geth and Parity both encrypt private keys with a user defined password, and store the output in a key file. I.E. They put the key to the safe in a lockbox.
Some tools like (my companies) EthTools.com encrypt private keys as mnemonics (12 or 24 word phrases which are more easy to remember). These are not encrypted, but are easier to remember. As they are not encrypted they need to be kept as secure as your private key would be - they are your private key.
Finally there are hardware wallets like the Ledger Nano S. These are essentially USB sticks which generate private keys. Upon setup you are given a mnemonic (see above) to recover your account (if necessary). The benefit of a hardware wallet is that it is essentially a separate computing environment that is well protected. As such no malware (that may be on your PC) will be able to access details about your account.
If you were simply using a Geth/Parity key file, and had malware on your computer then in principle that key file could be transmitted elsewhere and the bad guy could try and decrypt it. This is similar to a bad guy having stolen your lockbox. Now they have it, they can do whatever it takes to open it I.E Smash it with a hammer. That said it is easier to smash a lockbox than it is to decrypt a private key (assuming you have used a good password).
answered Aug 5, 2017 at 16:33
