How does Mist get access to all accounts in the private blockchain Geth node?

Question

I have a private blockchain node hosted somewhere in the cloud. And, I'm using Mist to access the accounts inside that node.

Since it's private node, I just store the private key inside that node and I'm fully aware that it's not safe to do - it's just a playground for me. Of course I'm not going to do it for mainnet/production.

When I ran Mist using the following command, Mist magically displayed all accounts that I have inside that node (it's running Geth):

$ /Applications/Mist.app/Contents/MacOS/Mist --rpc http://xxx.xxx.xxx.xxx:8545 --swarmurl null

Out of curiosity, I have the following questions:

1. How was Mist able to access all accounts I have inside that node?
2. Does it mean Mist can see the private keys inside that node as well?
3. Other than --rpc and --swarmurl flags, where can I get all available Mist CLI flags?

Answer 1

How was Mist able to access all accounts I have inside that node?

Geth's RPC exposes the standard eth_* namespace of methods, which includes an eth_accounts call. This lists all the available accounts on the node.

Does it mean Mist can see the private keys inside that node as well?

No, this is not possible. If the password is given, or the account is already unlocked, Mist can sign transactions, but it cannot access the key.

Other than --rpc and --swarmurl flags, where can I get all available Mist CLI flags?

Usage: /Applications/Mist.app/Contents/MacOS/Mist --help [Mist options] [Node
options]

Mist options:
  --mode, -m              App UI mode: wallet, mist.  [string] [default: "mist"]
  --node                  Node to use: geth, eth        [string] [default: null]
  --network               Network to connect to: main, test
                                                        [string] [default: null]
  --rpc                   Path to node IPC socket file OR HTTP RPC hostport (if
                          IPC socket file then --node-ipcpath will be set with
                          this value).                                  [string]
  --swarm                 Enable Swarm on start.                       [boolean]
  --swarmurl              URL serving the Swarm HTTP API. If null, Mist will
                          open a local node.
                                     [string] [default: "http://localhost:8500"]
  --gethpath              Path to Geth executable to use instead of default.
                                                                        [string]
  --ethpath               Path to Eth executable to use instead of default.
                                                                        [string]
  --ignore-gpu-blacklist  Ignores GPU blacklist (needed for some Linux
                          installations).                              [boolean]
  --reset-tabs            Reset Mist tabs to their default settings.   [boolean]
  --loglevel              Minimum logging threshold: info, debug, error, trace
                          (shows all logs, including possible passwords over
                          IPC!).                      [string] [default: "info"]
  --syncmode              Geth synchronization mode: [fast|light|full|nosync]
                                                                        [string]
  --version, -v           Display Mist version.                        [boolean]
  --skiptimesynccheck     Disable checks for the presence of automatic time sync
                          on your OS.                                  [boolean]

Node options:
  -  To pass options to the underlying node (e.g. Geth) use the --node- prefix,
     e.g. --node-datadir

Options:
  -h, --help  Show help                                                [boolean]