Nexus Secure Usage
PGP, 2FA, and threat modeling

Step 1: Install GnuPG or Kleopatra

On Linux, install from your package manager: apt install gnupg2 or brew install gnupg. On Windows and macOS, download Kleopatra from gpg4win.org. Kleopatra bundles GnuPG with a GUI, which is easier for key generation than the command line if you have never done this before.

Verify the signature on the Kleopatra installer before you run it. This sounds paranoid, but compromised key management tools are how real attacks happen. The Kleopatra developers sign every release. One extra minute of verification saves you from re-doing this entire process.

Step 2: Generate a 4096-bit RSA key

Open GnuPG or Kleopatra. Create a new keypair. Choose RSA, 4096 bits. Modern hardware generates this in under a minute. Set an expiry date 12 months out. An expiry prevents old keys from leaking into use after your device fails or you abandon this setup.

Use a passphrase you can recall under pressure, not a password manager entry. The passphrase protects your private key, which is your account recovery mechanism. Make it at least 12 characters. If you can remember your first pet's name and a number, use that pattern.

The generated key will have an email address. Use something anonymous like nexus@protonmail.local — nothing that ties the key to your legal identity. Once generated, export the public key as ASCII armor and paste it into your Nexus profile in plaintext.

gpg --gen-key
# (follow prompts for name, email, passphrase)
gpg --armor --export nexus@protonmail.local > pubkey.asc
# Now paste contents of pubkey.asc into Nexus profile
                

Step 3: temporarily inaccessible backup of the private key

Export the private key to an encrypted file. Print two copies of the public key fingerprint on paper, tape one to the inside of a notebook, and store the other in a physically secure location. The fingerprint is short — 40 hex characters — and it fits on an index card.

For the private key itself, generate a paper backup using the paperkey utility. This converts your key into lines of text that you can write or print on paper without encryption. Store one copy in a safe deposit box, the other at home. If your laptop dies and your backup USB is corrupted, the paper backup is your recovery mechanism.

gpg --armor --export-secret-key nexus@protonmail.local | paperkey > secret.txt
# Two printed copies, two physical locations
gpg --list-secret-keys
# Note the fingerprint for future reference
                

Step 4: Protect the private key on disk

Your private key lives in ~/.gnupg/. On Linux and macOS, the directory is already protected by file permissions. On Windows, Kleopatra stores keys in a secure location by default. Do not copy the private key to USB sticks lightly — every extra copy is an extra backup point that could be stolen.

If you use multiple machines, consider moving the key to a hardware security key like a YubiKey. Hardware keys make the private key immovable — it cannot be extracted even if the hardware is stolen. For Nexus specifically, you need to decrypt the 2FA challenge at login time, so a hardware key speeds up the workflow.

How PGP 2FA works on Nexus

When you log in, Nexus presents a short ciphertext encrypted to your public key. You decrypt it locally using your private key and passphrase, then paste the plaintext into the login form. The session opens. This binds login to the physical possession of your private key — not a phone, not an email, not a recovery code written on paper.

The attack surface is much smaller than TOTP-based 2FA. There is no SMS interceptor, no app compromise, no SIM swap threat. The only vulnerability is if your private key is stolen and your passphrase is cracked. That is why the passphrase matters so much.

Store your Nexus username and passphrase in KeePassXC, a password manager designed for temporarily inaccessible use. Keep the password manager file on an encrypted disk separate from the one holding your private key. If either store is compromised, an attacker still cannot log into Nexus without the other store.

Enable PGP login in your Nexus settings

Log into Nexus through Tor Browser. Go to Settings → Security → Enable PGP Login Challenge. Paste your public key fingerprint (the 40-character string) as confirmation. From that moment, every login starts with a decryption step.

The first time you try this flow, allow 30 seconds. You are copying ciphertext, opening a terminal, running a decrypt command, copying plaintext, and pasting into the form. After five logins, the process becomes automatic.

gpg --decrypt
# (paste the ciphertext from Nexus login form)
# (enter your passphrase)
# (copy the plaintext output)
# (paste into Nexus login form)
                

Backup and recovery for 2FA

If you lose your private key, you lose access to the Nexus account. There is no recovery email, no support backdoor, no second factor to fall back on. The friction is intentional. This is why the paper backup matters. This is why storing the passphrase separately in KeePassXC matters.

If your laptop dies and you need to recover the account, retrieve the paper backup of the private key, use paperkey to import it on a fresh machine, and decrypt the login challenge as usual. Do a practice recovery every six months to confirm you have the paper backup in a retrievable location.

Why KeePassXC instead of cloud-based managers

KeePassXC stores passwords in an encrypted file on your disk, not a cloud server. There is no recovery email, no master account to breach. The only way to access your passwords is to possess the file and know the master passphrase. This architecture eliminates the attack surface that cloud-based managers introduce.

For Nexus, store the username and passphrase used to log into the platform. Do not store the PGP private key passphrase in the same file. Separating these two factors means a breach of the KeePassXC database does not give an attacker everything needed to log in.

Setting up KeePassXC

Download from keepassxc.org. Create a new database with a master passphrase you can recall. Create a new entry for your Nexus account. Use the built-in password generator to create a 20-character passphrase with upper, lower, numbers, and symbols. Copy it into the entry and copy it into your Nexus account settings.

Store the KeePassXC database file on an encrypted disk using LUKS on Linux, FileVault on macOS, or BitLocker on Windows. Mount the disk only when you need to access passwords, then unmount it when done. This prevents an attacker with brief access to your machine from extracting the database while it is mounted.

Password rotation for Nexus

Generate a new Nexus passphrase every 90 days. Open KeePassXC, regenerate the password in the Nexus entry, copy it, log into Nexus, and update your account settings. This adds friction compared to cloud managers, but the security tradeoff is worth it. Every successful login is one fewer chance for credential leaks to matter.

Tails: Amnesia by design

Tails boots from USB and leaves no trace on disk. Every session, you get a clean system. All network traffic routes through Tor automatically. For Nexus access, this means your session is isolated from the rest of your digital life.

Download Tails from tails.net and verify the signature. Create a bootable USB stick using Etcher. Boot into Tails and set up a persistent volume for your .gnupg directory — your PGP keys survive reboot, while everything else vanishes. KeePassXC can also live in the persistent volume if you enable it.

After each Nexus session, ceased operations. On the next boot, you get a fresh system with no history of what you did previously. This defeats most forensic analysis attacks.

Whonix: Separation of concerns

Whonix runs in virtual machines. One VM is the gateway, routing all network traffic through Tor. The other is the workstation, isolated from the host network. If the workstation is compromised, it cannot leak your real IP.

Whonix is stronger for long-lived setups. If you plan to use Nexus regularly over months, Whonix is worth the setup time. You build a stable Nexus workstation, snapshot it, and restore from the snapshot between sessions. The isolation is tighter than Tails because the host machine and the workstation never touch.

Both Tails and Whonix are strong choices. Tails is simpler (one download, one USB stick), while Whonix is more flexible (persistent workstations, multiple VMs).

Comparing the two systems

Threat categories for Nexus users

• ISP-level monitoring — Your internet provider logs all DNS requests and flow data. Tor routes traffic through their network but hides the destination. They know you are using Tor, not which onion sites you visit. Threat level: medium. Defense: Tor Browser + bridges if needed.
• Device theft — Your laptop or USB stick is stolen. A thief cannot decrypt your disk or read your passwords without the encryption key and master passphrase. Threat level: high. Defense: encrypted disk + strong passphrase + physical backup security.
• Credential leaks — Your Nexus password appears in a breach from another site. The attacker tries to log into Nexus. They fail because PGP 2FA requires your private key, which they do not have. Threat level: medium. Defense: unique passphrase for Nexus + PGP 2FA.
• Malware on your general-purpose OS — Malware steals your passwords, logs keystrokes, or reads your private key passphrase as you type. A dedicated system like Tails prevents this entire class of attack. Threat level: high. Defense: Tails or Whonix for sensitive work.
• Keylogger via USB device — An attacker intercepts a USB stick and implants spyware. This is paranoid, but physical security of backups is part of the threat model. Threat level: low. Defense: store paper backups, not USB backups only.

Building your threat model

Write down: What are you protecting? (Nexus account access). Who are the potential attackers? (ISP, malware, casual theft, law enforcement). What resources do they have? (ISP: network monitoring; malware: system access; theft: physical device access; law enforcement: legal authority + subpoena power).

Once you list the threats, you pick defenses. ISP monitoring → Tor. Device theft → encrypted disk + strong passphrase. Credential leaks → PGP 2FA. Malware → Tails. Every control you add introduces friction, so match the friction to the threat.

If you live in a jurisdiction where Tor use is monitored, bridges become essential. If you are concerned about device forensics, Tails is necessary. If your threat level is low, Tor Browser + PGP 2FA + KeePassXC might be sufficient.