Best practice for storing a user's private key or mnemonic locally on their computer

Question

So, I'll immediately preface this question with a statement:

You should never share your private key or mnemonic phrase with anyone for any reason. This gives that person full access to your wallet, all of your tokens, etc. Do NOT share your private keys!

I will now follow this up with a contradiction and a rare use-case where this doesn't apply. Let me explain.

I've developed an application (local CLI-based app) that performs buy/sell limit orders on various assets in realtime. Essentially a "sniper" for executing orders immediately. You set parameters for a listing that meets your requirements, and if it does, it scoops it up immediately.

So here comes the issue: for myself, I am perfectly comfortable using my own private key on an application I've written by myself. But I plan on distributing this to a few friends, closed source (obfuscated node.js app). This is an issue because as an end-user, I'd want to know where my private key is going, along with this, is storing the passphrase or mnemonic in a YAML file the best way to go? I think not.

Essentially, I have two issues:

1. How could I somewhat prove that these keys are not being sent to a server somewhere (yes, users could use a request sniffing application, but they aren't all technically savvy)
2. What is the best practice for storing these keys? I was thinking potentially a one-time input that gets encrypted to some hash that I then un-hash in my application. It's a bit of a facade but definitely prevents any random person being able to open the file and see the key in plaintext.

I will also once again reiterate, this solution is gross, I don't want to be doing this, but unfortunately it's the only way. I don't want to use a browser with a Metamask provider because I want this to be fully automated, and so do my users.

Answer 1

You could use a proxy signer that uses a Vault or HSM to sign the transactions. See Ethsigner for instance. It makes the setup a bit more complex but what you want to do is not really possible without some isolation of the keys and signing process at a network level and with some encryption over the secrets. No honest answer will give you a safe way to distribute an obfuscated software while ensuring your users key are safe on computer directly connected to the internet. This is the whole purpose of hardware wallets. Now even with a proxy signer you still provide a way for a hacker to sign with your keys. But you reduce the risk of them to acces the keys. Even yourself won't be able to access the private keys. Also if you need your friends to trust your code not to do things with their money, you can still open source it and let them run it from source. It still requires that they can read code. But trust is one of these things that requires effort from both parts to exist. Last advise: make them use a separate wallet where they only put a small portion of their funds to interact with your software. Then they won't fear that you empty all their coins.

Answer 2

One option you could consider is using a keystore file, which is a JSON-formatted file that contains the encrypted private key. The user can provide their password to decrypt the key and use it for signing transactions. This way, the private key is not stored in plaintext in the YAML file, and the user has control over it.

Another option could be to use a hardware wallet, such as a Ledger or Trezor, to store the private keys. This way, the keys are never exposed to the application and the user can securely sign transactions using the hardware wallet.

As for proving that the keys are not being sent to a server, you could provide a clear and detailed explanation of how the application works and the security measures in place to protect the user's keys. You could also consider providing a way for users to verify the integrity of the application, such as through checksums or digital signatures.