Ask HN: What is the most secure way to host a form-driven website for an ICO
I was approached through a friend of a friend of a friend, to help with their ICO - (full disclosure - their product is crap and they just wanted to get into the craze, and I lovingly declined) -
BUT it got me thinking about the 'best way' to host a site for something like this. So I spent a few hours investigating and there isn't anything particularly conclusive that seems to incorporate recent events ( ICO hacks, DNS attacks, fakeurls, ransomware, etc ) and I didn't seem to find any previous discussion on HN about this, and so here we are..
Goal: Host a secure website which takes in user data safely, built to withstand 2018 ICO-attacks, and scale up as needed.
HN Goal: Turn this post into a reference point for others to help with their projects
Bugs/Features:
* Verify to the user that they are on the correct site in the first place
* Heavily guarded against brute-force attacks ( ssh, dos, mitm, remote exploits, etc )
* Capture some user data ( email address, wallet address, Name )
* Verify the user is who they say they are - or at least not a duplicate ( Email, 2FA, IP/Location tracking, or 3rd-party service )
* Provide feedback to the user for a successful entry
* Have a scalable-type solution for the DB
* Be able to handle 'lots' of users ( lets pretend needs to be working for: one million ants )
Couple of initial ideas for hosting:
* Lots of layers of caching ( Multiple CDN and Caching providers )
* Serverless Approach ( Lambda + AWS / GCE API-driven DB )
* Serverfull approach ( ec2 instance w/ selinux, lock down as much as possible, nginx/apache, TLS 1.3, high-bit security keys, etc, etc)
* ???
* Profit