Quote from: Vladimir on September 05, 2012, 12:23:13 PM

Quote from: DannyHamilton on September 05, 2012, 12:17:27 PM

A separate daemon can be written to run on the wallet box and reach out regularly (every second?) to a database held on some other box. Entries in this database can indicate actions that should be taken on the hot wallet (procedure numbers to indicate which function to run, additional columns or tables to hold parameters). The daemon can be written to validate the database entries against a set of sanity checks (size, frequency, destination, etc). It can then trigger an alert (pager, txt msg, phone call) to system administrators and refuse to process the request from the database when any transaction, or set of transactions, exceeds any sanity check. System administrators can then determine if the attempted interaction with the hot wallet is legitimate and handle the situation as needed. If the private keys for the hot wallet are known to be kept offline in cold storage, the daemon can even shut down bitcoind and delete the local copy of wallet.dat when it detects any obvious sign of intrusion.

Yep, this is a no brainer.

I've been thinking about a similar method as part of the code for an exchange I'm working on, and it's almost correct other than if somebody has access to your database and knows your rules, they can insert or alter records in the database table that controls your payment processing service. The solution here would be to have the requests (database records) be nonced & signed. Preferably with both a server/application private key and a per-user private key derived from the users password.