Quote from: Agnosticus on September 16, 2017, 11:47:50 PM

1) Using my method where it's a simple algorithm for me to remember the page number and location via a HUGE (and I mean HUGE) string of numbers - i.e. not your typical internet password. This wallet would exist in my head. Despite this, it's more vulnerable to attack because it doesn't have the entropy of a purely randomly generated number.

The page number and location that you find memorable, even if a "huge" string of numbers, is probably something that many other people would find memorable. Regardless of what number you choose, it will not be as secure as randomly generating a private key. What you are doing is similar to brain wallets which are notoriously insecure. Except your method is less secure as it does not include any key stretching or additional things to possible add randomness (e.g. hashing) that brain wallets do.

Quote from: Agnosticus on September 16, 2017, 11:47:50 PM

2) Using a randomly generated key which is less prone to attack, but is more easily forgotten or the details of which more easily lost. (This key would have to be stored somewhere physical, opening it up to being attacked in a way the first option wouldn't.)

There's nothing stopping you from randomly generating a private key and then figuring out its location on directory.io. Or randomly generating the page number and randomly generating the key index on directory.io so that you can memorize them for your key. That would be more secure than you choosing the location manually. You can even keep generating random numbers until you find one that is memorable to you. That is much more secure than you choosing your own private key.

Furthermore you are still vulnerable to many attacks (even the same ones that you thought you weren't vulnerable to) with your scheme.

First of all, you are essentially sending your private key to a remote web server (directory.io). The owner of that website can see that your browser would be visiting the same page over and over again. It would not be hard for them to just search through the private keys on that page and see which ones have coins and then steal them. In fact, any man in the middle could do this. The site doesn't even use https so anyone sniffing traffic on your internet connection (e.g. shared wifi) would be able to see exactly what page you are on and then just scan those private keys.

Secondly, you still need to load that private key into a wallet software in order to spend from it. You will probably have the private key on your clipboard, and the private key will be held in insecure places and in insecure memory. With a proper wallet software that generated your private key, the private key will remain in that software's memory (unless you export it). Your private key would then be able to be stolen by keyloggers and clipboard loggers which constitutes far more viruses than coin stealing viruses as coin stealing viruses much find specific files to steal your coins. This means that your key is much more vulnerable to viruses on your computer. Additionally you would still be vulnerable to traditional coin stealing viruses because most wallet software will write imported keys to a wallet file so normal coin stealing viruses can go steal those wallet files.

Thirdly, because the private key is in an unencrypted form, if the private key is stolen, then the thief can spend your coins immediately. With wallet encryption, if your coins are stolen, you still have time to move them as strong encryption and a strong password will protect your private keys.

Lastly, you would be reusing the exact same address over and over again which will lead to significant privacy loss. There's a reason that nearly all wallet software gives you a new address every time you want to receive coins and every time it makes a change output.