Private key Security

Question

I want to know how much secure is to store private key in the keosd and retrieve via http request and then use these keys in application for trasact an action ? and i don't want to force users to use scatter because of bad user experience. I want a possible secure solution for my application to save keys in which i create accounts for users from generated keys stored in keosd and then signed transaction from these keys. thank you help in advance

Answer 1

When storing in keosd, you can take preventive action to keep the keys out of your console's logs. Also, you can sign transactions in a cold-storage way so that you're only broadcasting the signed transaction.

Not sure what you mean by bad user experience on Scatter, I think it's the bee's knees.

Why would you want to generate the keys yourself? I wouldn't trust any application to do that. Maybe I'm missing something.

If you really want to create the keys, then I would suggest creating a customer permission level. A user could then add this customer permission level to their account and they could agree as to what the permission level can do in a Ricardian contract.