user2897: I want to create a collection of NFTs with unlimited supply. This way one NFT gets minted every time someone buys one. I don't need a limited supply because I want these NFTs to work as a "member ID" for a particular platform (I don't want a limited amount of users).
I understand that the minting policy will be unlocked for eternity.
What I am wondering right now is what happens with the security of the keys in this particular case: with locked minting policy NFTs this is not a risk, because if a malicious actor gets access to those keys, he/she won't be able to mint or burn any token.
What happens in this case? How can I assure a decent level of security if I want to build a server that will manage the minting of these member NFTs?
I think that this question can also be related to this other one, that hasn't received an answer yet: What is the best (and most secure) way to store private keys in an Express server?

user2335: If you want to add security to this setup, you might want to consider using a multi signature setup. Say, for example, a 3 out of 5 signatures are needed. Then an adversary needs to retrieve at least 3 keys to break the security of the minting policy. If you keep the keys on different machines, it's harder to break the security.
In addition, another excellent way is to use a hardware wallet for signing. This keeps the signing keys offline and never loads them on a computer.
It all a question about how far you want to go with security and how good do you implement the security.
In general, when you have signing keys on your machine, always store them encrypted with, for example, GnuPG. In this case, even if the machine is compromised the keys might not.
What kind of logic is necessary for a user to get access to such a platform? If this is paying you an x amount of ada this can be implemented with plutus scripts, this adds another layer of security.

2897: <p>I want to create a collection of NFTs with unlimited supply. This way one NFT gets minted every time someone buys one. I don't need a limited supply because I want these NFTs to work as a &quot;member ID&quot; for a particular platform (I don't want a limited amount of users).</p>
<p>I understand that the minting policy will be unlocked for eternity.</p>
<p>What I am wondering right now is what happens with the security of the keys in this particular case: with locked minting policy NFTs this is not a risk, because if a malicious actor gets access to those keys, he/she won't be able to mint or burn any token.</p>
<p>What happens in this case? How can I assure a decent level of security if I want to build a server that will manage the minting of these member NFTs?</p>
<p>I think that this question can also be related to this other one, that hasn't received an answer yet: <a href="https://cardano.stackexchange.com/questions/8231/what-is-the-best-and-most-secure-way-to-store-private-keys-in-an-express-serve">What is the best (and most secure) way to store private keys in an Express server?</a></p>
 2335: <p>If you want to add security to this setup, you might want to consider using a multi signature setup. Say, for example, a 3 out of 5 signatures are needed. Then an adversary needs to retrieve at least 3 keys to break the security of the minting policy. If you keep the keys on different machines, it's harder to break the security.</p>
<p>In addition, another excellent way is to use a hardware wallet for signing. This keeps the signing keys offline and never loads them on a computer.</p>
<p>It all a question about how far you want to go with security and how good do you implement the security.</p>
<p>In general, when you have signing keys on your machine, always store them encrypted with, for example, GnuPG. In this case, even if the machine is compromised the keys might not.</p>
<p>What kind of logic is necessary for a user to get access to such a platform? If this is paying you an x amount of ada this can be implemented with plutus scripts, this adds another layer of security.</p>
