do I need walletpassphrase in web script?

[vinboy]

hi
I'm running a bitcoin website.
I have a security concern here. Whenever someone withdraw bitcoin. My script will auto execute the withdrawal request.
Hence I use the function walletpassphrase in my script.

Is there any better and more secure way to execute the withdrawal task?
If hacker can hack the script, he will get my password and all the BTC in the wallet.


What are other proven secure way of doing this?
thank you

[hardshot]

Wallet on another server, with RPC Connection only allowed from your websites' address.

And: Do not store 100% in your hot wallet.

[vinboy]

ok that's a way.. thanks

[BitCoinDream]

How about using blockchain.info api ?

[hardshot]

How about using blockchain.info api ?

Has been unreliable in the past.. All those downtimes

[vinboy]

even if use blockchain.info, the password still needs to go into the script somewhere. That's where i find it high risk.

[byt411]

hi
I'm running a bitcoin website.
I have a security concern here. Whenever someone withdraw bitcoin. My script will auto execute the withdrawal request.
Hence I use the function walletpassphrase in my script.

Is there any better and more secure way to execute the withdrawal task?
If hacker can hack the script, he will get my password and all the BTC in the wallet.


What are other proven secure way of doing this?
thank you

LOL, so you want to repeat gox?

Even with the transaction malleability fixes, you can get bombarded by fake txes and you will be doomed.

[vinboy]

hi
I'm running a bitcoin website.
I have a security concern here. Whenever someone withdraw bitcoin. My script will auto execute the withdrawal request.
Hence I use the function walletpassphrase in my script.

Is there any better and more secure way to execute the withdrawal task?
If hacker can hack the script, he will get my password and all the BTC in the wallet.


What are other proven secure way of doing this?
thank you

I would be glad to help you work on using my api and a cold storage wallet. Then you could do withdraws on your own computer without it being linked to your server.

thanks... does your api work with blockchain.info or bitcoind?