Say that a machine is running an Ethereum client (geth or Parity), and it also has a web application (running as a NodeJS server, say) that provides a front-end to users and communicates with the local Ethereum node using web3 calls from within its Javascript code. If the web application wants to provide a feature for the users to create an account on Ethereum, it could provide a form to the user to do that, and implement it by calling web3.personal.newAccount(<password>)
, using IPC on the local Ethereum node. However, the keys would be generated on the Ethereum node and would have to be managed by the web application.
Is there another way to do this such that the key-pair is generated on the user's machine so that the private key remains exclusively with the user? One way could be by using MetaMask, which (I have read) is a Chrome extension that "injects web3" into the browser. That would make it possible to generate keys on the user's machine. MetaMask would also be needed later for user to send signed transactions because the signing has to be done on the user side. Would that also be mean that the signed transaction would be sent directly from browser to the Ethereum node by calling web3.eth.sendRawTransaction(...)
(web3
being provided by MetaMask) and not via the web application as a proxy ?
But then all this would force the user to use the Chrome browser and have the MetaMask extension installed. Is there a way to remove this limitation? Or is it true that a web application (i.e. running on a centralized server) that lets remote users create Ethereum accounts has to manage the keys itself?