Why exposing the personal API is unsafe?

Question

From what I am reading in various places such as here ,here or here, it is not safe to expose the personal api to the front-end Dapp via RPC.

Hence asking the users to run geth --rpc --rpcapi "eth,net,web3,personal" --rpccorsdomain "http://yourDomain is not safe.

My question is why is that the case? I have the impression the links I provided gloss through it but I am still a bit unclear.

Thanks!

EDIT

From the answers I would like to expand/clarify a bit on my confusion:

A user logs into his computer and typesgeth --rpc --rpcapi "eth,net,web3,personal" --rpccorsdomain "http://yourDomain.com" on the terminal.

This enables his node to listen to http://yourDomain.com . Then he opens a browser and goes to the Dapp at http://yourDomain.com.

Then sure he would be able to mess around with his own node and accounts but how an external attacker could do that?

Answer 1

1. Information disclosure: personal.listAccounts , will tell what are the addresses ( external account) that node contains.
2. Brute force: Keep asking to unlock account [personal.unlockAccount()] by using listAccounts( above function),locking existing accounts ( personal.lockAccount) randomly.Inadvertently DoS attack
3. Unnecessary Account creation: personal.newAccount() , keep creating accounts,may be billions of them so that your server space fills up ( geth creates keystore files on account creation)

Updates:

Who would be able to do hacking ?

Answer: Anyone, with malicious intention.

How would someone be able to perform the above tasks ?

Answer: From his browser console, he could do the following.

     var Web3 = require('web3');
         var web3 = new Web3();
         web3.setProvider(new web3.providers.HttpProvider("http://yourDomain"));
for(i=0;i<100000000;i++){
web3.personal.newAccount(/*some random function*/);
}// There the hacker could able to create 100000000 many accounts in your server.
web3.eth.defaultAccount="0xHackersOwnAccount"; //As the hacker knows somehow all incoming money transfer is to your default account, but alas !!  no more

I hope I did not teach wrong guy.