Create new Ethereum accounts and store them in the node using JSON-RPC

Question

I want to develop a website where each registered user can generate new Ethereum address, send their coins and later exchange them into other coins. I want to implement the following functionalities:

• Generate new Ethereum address when the user wants and store the keys into my Ethereum node giving the user better user experience and allowing them to withdraw their funds at any time.

• Generate the new account over JSON-RPC if it is possible and secure. I asked this in this link and read a lot of posts telling that it is an insecure way but I don't really understand the reason why. I am newbie to Ethereum environment but I want to start the development of my project and I haven't any other problem in start with another way different from JSON-RPC if it is secure and I can store accounts into my node

I think that maybe I am not understanding something about Ethereum environment because I don't see a secure and easy way to do it. And if I am not wrong, Coinbase works in that way: they generate, save the ethereum wallets and the user just need to send or withdraw their money; so there must be a way to do it. If someone could guide me on how to get started, how to use geth for that purpose or a library would be grateful.

Answer 1

The security of using the JSON-RPC usually revolves around the security of whatever system it's running on. JSON-RPC itself is relatively insecure--meaning if the port it's listening on is exposed, anyone can control your node--including the account management aspects.

There have been a number of incidents in the past where someone left their node listening on a public port and had their funds stolen.

You might want to consider using the IPC interface, instead, as you can generally enforce more strict permissions around the IPC pipe.

If you're planning on providing a service that's publicly accessible, however, you'll want to ensure the node that's running is on an isolated system that has minimal interaction with your public-facing system. There are a lot of security concerns around having a node running on a public-facing system--do your research and be very diligent about all aspects of system security.