When creating an account with the Mist wallet, is the password a key for encrypting my wallet file or is it for something else?

Question

In the book "Introducing Ethereum and Solidity", there is a paragraph that says:

"There is no Forgot Password functionality in the Ethereum network. That’s because your password is only for this local instance of the Mist wallet; it’s not saved on the Ethereum blockchain. In fact, your private key is all you need to re-create this account on any other computer running Mist. The password you create merely protects you from an interloper sitting down at your computer and spending your money through the Mist interface. It does not stop anyone from stealing your private keys from your computer’s file system, if it’s left unprotected."

Does this mean that Mist doesn't encrypt my wallet file/private keys?

Answer 1

My reading of the paragraph is the same as yours. It appears to imply that the private key is stored unencrypted on your computer.

I'm pretty sure this is not the case. Mist stores the private key encrypted with your password. Here are some details about how: https://github.com/ethereum/wiki/wiki/Web3-Secret-Storage-Definition.

(I'm agreeing here with Rob Hitchens, just also supporting the idea that the paragraph seems to indicate the opposite.)

Answer 2

The private key is stored locally. It's not meant to be exposed ever. If someone were to get into your computer an inspect the file that contains the private key (signing key), they would also need knowledge of your password to decrypt the private key.

Put another way, possession of a key file doesn't help anyone unlock the account unless they also have knowledge of the password that was used to create it.

Hope it helps.