So, I'll immediately preface this question with a statement:
You should never share your private key or mnemonic phrase with anyone for any reason. This gives that person full access to your wallet, all of your tokens, etc. Do NOT share your private keys!
I will now follow this up with a contradiction and a rare use-case where this doesn't apply. Let me explain.
I've developed an application (local CLI-based app) that performs buy/sell limit orders on various assets in realtime. Essentially a "sniper" for executing orders immediately. You set parameters for a listing that meets your requirements, and if it does, it scoops it up immediately.
So here comes the issue: for myself, I am perfectly comfortable using my own private key on an application I've written by myself. But I plan on distributing this to a few friends, closed source (obfuscated node.js app). This is an issue because as an end-user, I'd want to know where my private key is going, along with this, is storing the passphrase or mnemonic in a YAML file the best way to go? I think not.
Essentially, I have two issues:
- How could I somewhat prove that these keys are not being sent to a server somewhere (yes, users could use a request sniffing application, but they aren't all technically savvy)
- What is the best practice for storing these keys? I was thinking potentially a one-time input that gets encrypted to some hash that I then un-hash in my application. It's a bit of a facade but definitely prevents any random person being able to open the file and see the key in plaintext.
I will also once again reiterate, this solution is gross, I don't want to be doing this, but unfortunately it's the only way. I don't want to use a browser with a Metamask provider because I want this to be fully automated, and so do my users.