You need to tell your friend to wise up if he want's to use a online wallet. A lot of the online wallets won't allow you to know your private key so if the website ever goes down through DDOS or other attacks then you won't be able to access your Bitcoin.