This question was asked on Reddit:
Is there a secure/recommended solution to unlock an account and send a tx through the Web3 interface (from a Html page)?
One of the alternatives that I have in mind is just to disable the Rpc and create a layer, and expose custom methods through it.
The safest way to do this is to not rely on unlocking the account at all; instead, use ethereumjs and web3 to build your app to hold keys itself, and generate transactions which you submit with eth.sendRawTransaction. That way, you can do key management yourself, your user only has to trust you with funds they send to their account in your app, and you don't need the user to be running a node with unlocked accounts (or a node at all, if you use something like Infura).
