Currently for payouts I'm using a traditional tz1 addr, which is managed by the default tezos-signer binary. However, it appears to me not that safe. Some kind of HSM + KMS (say, from Google or from Amazon) seems to be a better solution. But this path requires using tz2 and tz3 addresses, which in practice might cause some problems. So, maybe, someone came up with working and well-tested setups apart from one that is described in the trd docs.
Add a comment
|
1 Answer
Using an HSM from a cloud provider comes at significant cost. AWS CloudHSM for example is just above $USD1,000/month. The other downside here is vendor lock-in. You cannot import an existing key into cloud providers, and if you want to leave/switch, you cannot export it. You have to transfer/change addresses. If this is your payouts address, that's probably not a big deal.
TRD can run anywhere. You can use a ledger at home, and run TRD on your home computer with tezos-signer utilizing the ledger. Downside, you must click the ledger to make payouts (ie: no automated payments, which is what TRD is best at)
Security always comes at a cost of convenience.
