<p>In most cases, you should never manage users wallets with a hosted service. The whole point of a decentralized blockchain is that users are managing their own assets.</p>
<p>The best practice is to generate and keep the keys used in signing of a transaction within the iOS application managed by the user and use a hosted service to communicate with the Cardano blockchain (something like <a href="https://blockfrost.io" rel="noreferrer">blockfrost.io</a> or a hosted cardano-db-sync instance).</p>

CC BY-SA 4.0
2021-12-29T23:21:27.930Z
What if I'm using cardano-wallet to generate the pass-phrase and set a password - where does this get set? I can't use blockfrost to create a wallet, and I don't want to be responsible for the wallet either.
Jeffrey Berthiaume
CC BY-SA 4.0
2021-12-30T11:54:53.423Z
Your code needs to generate the passphrase, your application needs to protect the keys with a password. The user must be responsible for the wallet.
Marek Mahut - StakeNuts
CC BY-SA 4.0
2021-12-29T09:34:37.320Z
2021-12-29T09:34:37.320Z
Marek Mahut - StakeNuts
<p>I want to use a public cardano-wallet server running on mainnet, so I can connect to it and create wallets for users of my iOS app.</p>
<ol>
<li><p>How can I set up all transactions to be encrypted (over SSL) instead of over http?</p>
</li>
<li><p>Does the server keep logs of requests, and if so, how can I clear them? (I don't want to save a local record of anything I receive)</p>
</li>
<li><p>Are there any other security concerns?</p>
</li>
</ol>

<wallet><api><mainnet>
What are the security implications to having cardano-wallet run on a public server?
# What are the security implications to having cardano-wallet run on a public server?

(Asked by: username_0 on 2021-12-28)

I want to use a public cardano-wallet server running on mainnet, so I can connect to it and create wallets for users of my iOS app.

1. How can I set up all transactions to be encrypted (over SSL) instead of over http?
2. Does the server keep logs of requests, and if so, how can I clear them? (I don't want to save a local record of anything I receive)
3. Are there any other security concerns?

**Tags:** wallet, api, mainnet

---

## 1 answers

### Answer by username_1 on 2021-12-29. Score: 6 | Accepted answer

In most cases, you should never manage users wallets with a hosted service. The whole point of a decentralized blockchain is that users are managing their own assets.

The best practice is to generate and keep the keys used in signing of a transaction within the iOS application managed by the user and use a hosted service to communicate with the Cardano blockchain (something like [blockfrost.io](https://blockfrost.io) or a hosted cardano-db-sync instance).

> **Comments:**
> **username_0**: What if I'm using cardano-wallet to generate the pass-phrase and set a password - where does this get set? I can't use blockfrost to create a wallet, and I don't want to be responsible for the wallet either.  
> **username_1**: Your code needs to generate the passphrase, your application needs to protect the keys with a password. The user must be responsible for the wallet.  

---

