user2092: I am trying to understand the extreme caution about creating secrets for the BP node.
Is the concern about not knowing what one might lease in the cloud, or how security is in such a company, or their retainment proceeders, or multiplexing protocols, or is it about the software we're building to run the node?
Some cases, air gapping seems silly and I can imagine people outputting these secrets into their DropBox or OneDrive, etc.
If I run my own cluster, I really do not have to airgap right? I can simply mount a tempfs over USB, or any other number of solutions.
Just trying to clear this up.
Where does the cause for concern mainly originate?

user161: The pool keys control the pool and can never be changed. If your pool keys are exposed, then you have lost control of your pool (this doesn't necessarily mean your pledge, but control of the fees, where the rewards go, the deposit, etc.).
If you create these keys on an online machine there is increased risk of the keys being exposed, for example from things like:

Running malicious software (think about how much code written by strangers you run on your machine - software, games, etc.)
Being included in backups left around on drives/USB sticks or uploaded to the cloud

You may consider these risks small, but they're risks all the same. You only have to expose your keys once for it to be game over for your pool.
Given these keys don't need to be on a connected machine, it therefore seems sensible to create them on a machine that is never connected to the internet. It massively reduces the risk.

2092: <p>I am trying to understand the extreme caution about creating secrets for the BP node.</p>
<p>Is the concern about not knowing what one might lease in the cloud, or how security is in such a company, or their retainment proceeders, or multiplexing protocols, or is it about the software we're building to run the node?</p>
<p>Some cases, air gapping seems silly and I can imagine people outputting these secrets into their DropBox or OneDrive, etc.</p>
<p>If I run my own cluster, I really do not have to airgap right? I can simply mount a tempfs over USB, or any other number of solutions.</p>
<p>Just trying to clear this up.</p>
<p>Where does the cause for concern mainly originate?</p>
 161: <p>The pool keys control the pool and can never be changed. If your pool keys are exposed, then you have lost control of your pool (this doesn't necessarily mean your pledge, but control of the fees, where the rewards go, the deposit, etc.).</p>
<p>If you create these keys on an online machine there is increased risk of the keys being exposed, for example from things like:</p>
<ul>
<li>Running malicious software (think about how much code written by strangers you run on your machine - software, games, etc.)</li>
<li>Being included in backups left around on drives/USB sticks or uploaded to the cloud</li>
</ul>
<p>You may consider these risks small, but they're risks all the same. You only have to expose your keys <em>once</em> for it to be game over for your pool.</p>
<p>Given these keys don't <em>need</em> to be on a connected machine, it therefore seems sensible to create them on a machine that is never connected to the internet. It <em>massively</em> reduces the risk.</p>
