2

I'm working on a Stellar-based app. Part of our protocol requires us to submit transactions from users accounts. We'd prefer to have users enter their secret keys when their accounts need to submit the transactions. Then we wouldn't need to store the secret keys. What would be the best way to securely pass the users secret key between the user, us, and Stellar? Is caching the key on the users device considered secure?

Alternatively, would it be considered more secure to have users set up accounts on our application that are associated with Stellar accounts that we store the secret keys for?

2

There is a catchphrase that says: Not your keys, not your coins. Private keys should only be known/managed/used by their owner and nobody else.

If you want it the trustless crypto way: Pass an unsigned transaction to the user, let them sign it with their private key (which you'll never have access to) and send the signed transaction back to you / or submit it directly to the network.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.