What does it mean to "password protect" your wallet on Multibit?

Question

Isn't my wallet (i.e. my private key) already private? What does it mean to set a password for it? I assumed it encrypted the wallet file, but this answer seems to point otherwise. How can they verify the password? I don't feel very comfortable sending it to a server, and it doesn't seem any safer to store a password with the wallet file than just have a wallet file without a password. However if it does encrypt the wallet, what software is used?

I'm very unsure of multibit, it seems very non-transparent. The wallet file seems to be a binary file instead of a plain text one with my key (granted plain-text "isn't safe", but so isn't a binary file that can be used by an attacker on his multibit client). I don't even know what multibit is doing with that file...

Thanks... Noob here.

Answer 1

Your wallet.dat file contains your private key. By default this is saved in clear text. Meaning that anybody who gets a hold of this file, could see the private key and therefore spend your money.

When password protecting this file, to see the private key, you need a password. MultiBit uses a well known Java library to "password protect" it. It's all open source and well peer reviewed.

If you don't trust MultiBit you can still encrypt your wallet.dat file using other software. You must also understand that if you decide to unprotect your wallet file, it's not necessarily the case that people will be able to steal your money; they would still have to get a hold of the wallet.dat file.

So, it's best practice to password protect it, so in case you lose your file, or a hacker enters your computer, they won't be able to spend your money because they would need the password.