I have a few questions:
1. Issue asset
from: http://wiki.nxtcrypto.org/wiki/Nxt_API
http://localhost:7876/nxt?
requestType=issueAsset&
secretPhrase=SECRET&
name=ASSETNAME&
description=DESCRIPTION&
quantity=QTY&
fee=FEE&
referencedTransaction=REFTX
Does one sends his own private key in the open??
(attacker might just need to activate WireShark on the attacked remote computer to sniff it...)
2. I read somewhere that BCNext had made a few tweaks to a well known elliptic curve algorithm.
Why did he do it? (one minus that I see is that It is not "proven" and we needed auditing).
3. Can someone send assets from one account to the other without going through the asset exchange? (for example from one account that I have to the other)
The "tweaks" were porting to Java, including an implementation bug. This bug has been identified and fixed and the code has been reviewed by Dr. Evil himself, aka Jesse James. Also, the encryption choices BCNext made were a bit ahead of time, now openssl is making the same type of choice.
There is the transferAsset API call that lets you send assets to any account