Yep, storing your bitcoins in a plain web app is definitely a bad idea. The current trend in the bitcoin space is a mixture of:
* Discouraging the use of the webapp (if any available) in favor of a browser application (chrome app, firefox app, etc)
* 2 factor auth to login
* Bitcoin "multisig" transactions: require at least N out of M valid private keys (allowing the storage of these keys to be on different devices/services/media) before releasing funds
* Discouraging the use of the webapp (if any available) in favor of a browser application (chrome app, firefox app, etc)
* 2 factor auth to login
* Bitcoin "multisig" transactions: require at least N out of M valid private keys (allowing the storage of these keys to be on different devices/services/media) before releasing funds
And of course encryption before storage.