Can I write Web3 interface which runs in a browser, allowing the user to do "protected" operations without him uploading his private key to my server?
First of all, you never should upload private key to your server. None of dApps behave like that.
Any user that has Metamask/Parity or such plugin installed in their web browser can interface with your web3 interface. No magic needed. Just include web3.js in your site Javascript context.
Metamask will sign the Ethereum transactions on the client side and your server will only see the signed transactions.
More information:
answered Mar 27 '18 at 12:39
