5
When I create an account via my desktop browser, I am assured that the password only exists on my browser, and is not saved.
So, if I "pair" an Android device with MyWallet, can or can't I send BTC without entering the password?
How does this work with/without a secondary password? What if I first installed the Android app, and only then created a secondary password?
Are the files on my Android device / Dropbox encrypted with my first password? My second password? Both?
1
Here is the complete answer from the forum:
When I create an account via my desktop browser, I am assured that the password only exists on my browser, and is not saved.
So, if I "pair" an Android device with MyWallet, can or can't I send BTC without entering the password?
Yes you can send BTC without entering the password because the password is contained within the pairing QR Code (The QR Code is constructed using javascript).
How does this work with/without a secondary password? What if I first installed the Android app, and only then created a secondary password?
The second password is not contained within the pairing QR Code so you will be prompted to enter it in the iPhone app.
If you set a second password after pairing with only single password after the app syncs the wallet on startup a second password will be required from then on and the original wallet is deleted. If your phone was stolen enabling double encryption doesn't protect your wallet if it was already stored onto the device.
Are the files on my Android device / Dropbox encrypted with my first password? My second password? Both?
The wallet format is document here:
https://blockchain.info/wallet/wallet-format
For single encryption the entire JSON payload is encrypted with your first password.
With double encryption each private key is encrypted first with the second password and then the payload is encrypted with the first password. (In the web interface click [Import / Export] then [Export Unencrypted] and from the select box choose "Leave private keys encrypted" to see the format)
The wallet is saved in exactly the same way whether stored on the server/app or dropbox.
1
I think when you scan the QR code, your password is encoded in that barcode, so your Android phone stores it locally.
I haven't tested it myself, but considering this I think you have to enter the secondary password to your Android phone as well. It will either require you to do it every time you make a transaction or remember it for you.
1It requires it every time. So it seems like you have to use a secondary password if you don't want anyone who picks up your smartphone to be able to empty your wallet. – ripper234 – 2012-05-25T06:10:12.847