We cannot (and don't want to):
- View your balance
- View your address book
- Make transactions on your behalf
- Confiscate your wallet
- Lock you into our service.
They do this by only storing the encrypted wallet file containing the private keys, and letting the web client do the decryption and signing using the private keys without ever communicating them using the server. This means it is indeed true that the blockchain.info can't make transactions on your behalf.
I used to think this also meant that, if a hacker broke into their servers, they would not be able to steal everybody's bitcoins, because the private keys are not stored there.
It would take longer, as everyone would have to sign in to be compromised... but they'd still be able to steal a bunch of Bitcoins.
Am I missing something or is this indeed the current state of affairs with blockchain.info?
(Note this is not meant to be a dig at this particular website; it's really more of a security question in general.)