From b3e009730cf07d888b746f0c2aeff59ca0b0026a Mon Sep 17 00:00:00 2001
From: fiatjaf <fiatjaf@gmail.com>
Date: Wed, 17 Jun 2026 10:59:22 -0300
Subject: [PATCH] use a default key that is different for each machine.

---
 bunker.go      |  2 +-
 go.mod         |  1 +
 go.sum         |  2 ++
 helpers_key.go | 16 ++++++++++++++++
 key.go         | 12 ++++++++++++
 main.go        |  7 ++-----
 6 files changed, 34 insertions(+), 6 deletions(-)

diff --git a/bunker.go b/bunker.go
index 7a5b8e1..73f9337 100644
--- a/bunker.go
+++ b/bunker.go
@@ -185,7 +185,7 @@ var bunker = &cli.Command{
 		if config.Secret.Plain == nil && config.Secret.Encrypted == nil {
 			sec := os.Getenv("NOSTR_SECRET_KEY")
 			if sec == "" {
-				sec = defaultKey
+				sec = defaultKey().Hex()
 			}
 			sk, err := nostr.SecretKeyFromHex(sec)
 			if err != nil {
diff --git a/go.mod b/go.mod
index 1d8c4d0..b6c3953 100644
--- a/go.mod
+++ b/go.mod
@@ -29,6 +29,7 @@ require (
 
 require (
 	fiatjaf.com/lib v0.3.7
+	github.com/denisbrodbeck/machineid v1.0.1
 	github.com/hanwen/go-fuse/v2 v2.9.0
 	github.com/itchyny/gojq v0.12.19
 	github.com/lithammer/fuzzysearch v1.1.8
diff --git a/go.sum b/go.sum
index d5208f0..97a8933 100644
--- a/go.sum
+++ b/go.sum
@@ -102,6 +102,8 @@ github.com/decred/dcrd/dcrec/secp256k1/v4 v4.0.1/go.mod h1:hyedUtir6IdtD/7lIxGeC
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 h1:NMZiJj8QnKe1LgsbDayM4UoHwbvwDRwnI3hwNaAHRnc=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0/go.mod h1:ZXNYxsqcloTdSy/rNShjYzMhyjf0LaoftYK0p+A3h40=
 github.com/decred/dcrd/lru v1.0.0/go.mod h1:mxKOwFd7lFjN2GZYsiz/ecgqR6kkYAl+0pz0tEMk218=
+github.com/denisbrodbeck/machineid v1.0.1 h1:geKr9qtkB876mXguW2X6TU4ZynleN6ezuMSRhl4D7AQ=
+github.com/denisbrodbeck/machineid v1.0.1/go.mod h1:dJUwb7PTidGDeYyUBmXZ2GphQBbjJCrnectwCyxcUSI=
 github.com/dgraph-io/ristretto/v2 v2.3.0 h1:qTQ38m7oIyd4GAed/QkUZyPFNMnvVWyazGXRwvOt5zk=
 github.com/dgraph-io/ristretto/v2 v2.3.0/go.mod h1:gpoRV3VzrEY1a9dWAYV6T1U7YzfgttXdd/ZzL1s9OZM=
 github.com/dgryski/go-farm v0.0.0-20240924180020-3414d57e47da h1:aIftn67I1fkbMa512G+w+Pxci9hJPB8oMnkcP3iZF38=
diff --git a/helpers_key.go b/helpers_key.go
index 1161fa4..3a39583 100644
--- a/helpers_key.go
+++ b/helpers_key.go
@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"crypto/sha256"
 	"fmt"
 	"os"
 	"strings"
@@ -13,11 +14,26 @@ import (
 	"fiatjaf.com/nostr/nip46"
 	"fiatjaf.com/nostr/nip49"
 	"github.com/chzyer/readline"
+	"github.com/denisbrodbeck/machineid"
 	"github.com/fatih/color"
 	"github.com/mattn/go-tty/v2"
 	"github.com/urfave/cli/v3"
 )
 
+// the default secret key we will use when "--sec" is not provided
+func defaultKey() nostr.SecretKey {
+	mid, err := machineid.ID()
+	if err != nil {
+		k := nostr.SecretKey{}
+		k[29] = 'n'
+		k[30] = 'a'
+		k[31] = 'k'
+		return k
+	}
+
+	return sha256.Sum256([]byte(mid))
+}
+
 func gatherKeyerFromArguments(ctx context.Context, c *cli.Command) (nostr.Keyer, nostr.SecretKey, error) {
 	key, bunker, err := gatherSecretKeyOrBunkerFromArguments(ctx, c)
 	if err != nil {
diff --git a/key.go b/key.go
index 30301f2..b1ce7fe 100644
--- a/key.go
+++ b/key.go
@@ -28,6 +28,7 @@ var key = &cli.Command{
 		decryptKey,
 		combine,
 		validate,
+		defaultCommand,
 	},
 }
 
@@ -235,6 +236,17 @@ Returns error if key is invalid, otherwise exits successfully.`,
 	},
 }
 
+var defaultCommand = &cli.Command{
+	Name:                      "default",
+	Usage:                     "prints the default secret key",
+	Description:               `the default secret key is generated differently for each machine (or falls back to a hardcoded one in case of failure), it is not save in any way, but this command makes it available if that is needed.`,
+	DisableSliceFlagSeparator: true,
+	Action: func(ctx context.Context, c *cli.Command) error {
+		stdout(nip19.EncodeNsec(defaultKey()))
+		return nil
+	},
+}
+
 var combine = &cli.Command{
 	Name:  "combine",
 	Usage: "combines two or more pubkeys using musig2",
diff --git a/main.go b/main.go
index ece589a..778c01c 100644
--- a/main.go
+++ b/main.go
@@ -15,8 +15,6 @@ import (
 	"github.com/urfave/cli/v3"
 )
 
-var defaultKey = nostr.KeyOne.Hex()
-
 var authFlags = []cli.Flag{
 	&cli.BoolFlag{
 		Name:     "auth",
@@ -35,11 +33,10 @@ var defaultKeyFlags = []cli.Flag{
 	&cli.StringFlag{
 		Name:        "sec",
 		Usage:       "secret key to sign the event, as nsec, ncryptsec or hex, or a bunker URL",
-		DefaultText: "the key '01'",
 		Category:    CATEGORY_SIGNER,
 		Sources:     cli.EnvVars("NOSTR_SECRET_KEY"),
-		Value:       defaultKey,
-		HideDefault: true,
+		Value:       defaultKey().Hex(),
+		DefaultText: "a default key specific to your machine, see it with `nak key default`",
 	},
 	&cli.BoolFlag{
 		Name:     "prompt-sec",