Do I see that right, if I generate an address for a coin (other than nxt), there is no possibility to read the private key out of the app? Just directly from javascript?
And there is no possibility to use an own private key? And if I delete the cookies/local storage, all information is gone??
So isn't it very risky to transfer something on those accounts?
The tech behind the multiwallet is the Multigateway -
http://multigateway.org/ (which needs some updates for this release, btw)
In short, this is distributed multisignature wallets. When you generate an address, a request is sent to the Multigateway servers, where a multisig address is generated and bound to the SuperNET/Nxt account that requested it. Those addresses are retrieved from the Lite client through a set of relay nodes, and although the address string is then stored in your local browser storage, the private keys are in the Multigateway servers.
Then when a deposit is made to the multisig address, the servers pick it up and deliver to the corresponding SuperNET/Nxt account the same amount of superCOIN tokens, which are backed up by coins deposited in the distributed multisig wallets.
So - Is there a possibility to use your own private key for, say BTCD? No. And if you wipe your machine clean, is all information gone? Nope. Your coin assets are on the Nxt blockchain, and the address is stored in the servers. Generating again a BTCD address from a new machine, for the same SuperNET/Nxt account, will return the same deposit address.
But the coin addresses are useful for deposits, not for monitoring your balance, because the balances in different multisig addresses change internally in the wallets as operations happen (change outputs in coin transactions). The amount of coins you have is the number of superCOIN assets in your account, not the balance in your deposit address. It is not the same as a traditional exchange where you have a deposit address, and then there's a hot/cold wallet account where everything flows to and from, because here there is multiple multisig addresses distributed in several servers. But the concept of "this is a deposit address, not your balance" also applies for non-Nxt coins in this lite wallet.