This seem legit...

#1

Post by darkbot » Thu, Oct 31, 2013, 11:52 AM UTC

This seem legit...
trustico.ch

Re: This seem legit...

#2

Post by chmod775 » Thu, Oct 31, 2013, 12:15 PM UTC

To clarify: DO NOT DO THIS.

1. Never give your private key to anyone

2. Especially not if it is sent over an unencrypted connection (the site doesn't even use https)

3. Don't. Just don't.

This is either the weakest attempt of the NSA to collect private SSL keys ever, or this company actually has zero knowledge of the product they're selling and shouldn't be trusted with your site's security

Re: This seem legit...

#3

Post by codfrantic » Thu, Oct 31, 2013, 12:16 PM UTC

I was hoping it was at least javascript...

Re: This seem legit...

#4

Post by tankenmate » Thu, Oct 31, 2013, 12:16 PM UTC

Woah, I couldn't ever envisage ever trusting a "security company" that not only encouraged you to disclose your private key, but also provided a form for doing it over a non encrypted connection!

My personal opinion is don't use these guys; this is either a school boy error/complete incompetence or totally dubious.

Re: This seem legit...

#5

Post by jawr » Thu, Oct 31, 2013, 12:25 PM UTC

Brilliant.

Re: This seem legit...

#6

Post by mgbmtl » Thu, Oct 31, 2013, 12:30 PM UTC

Wow, at first I seriously thought this site was a fake copy of the official Trustico site (they have trustico.ca, trustico.com, etc)... but the form exists on all their sites:

http://www.trustico.ca/ssltools/match/cert-and-key-pem/check...

Re: This seem legit...

#7

Post by namuol » Thu, Oct 31, 2013, 12:34 PM UTC

chmod775 wrote: post #2

To clarify: DO NOT DO THIS. 1. Never give your private key to anyone 2. Especially not if it is sent over an unencrypted connection (the site doesn't even use https) 3. Don't. Just don't. This is either the weakest attempt of the NSA to collect private SSL keys ever, or this company actually has zero knowledge of the product they're selling and shouldn't be trusted with your site's security

I love how suddenly the NSA is the only entity out there who has an interest in private keys.

Re: This seem legit...

#8

Post by elithrar » Thu, Oct 31, 2013, 12:34 PM UTC

I had these guys @reply me on Twitter when I tweeted about how it's easier to figure out what cipher suite to use compared to figuring out what SSL product I need.

They were helpful but thank god I didn't buy a cert from them: this page is a terrible, terrible idea that erodes their trust completely.

Re: This seem legit...

#9

Post by blueblob » Thu, Oct 31, 2013, 12:36 PM UTC

namuol wrote: post #7

chmod775 wrote: post #2

To clarify: DO NOT DO THIS. 1. Never give your private key to anyone 2. Especially not if it is sent over an unencrypted connection (the site doesn't even use https) 3. Don't. Just don't. This is either the weakest attempt of the NSA to collect private SSL keys ever, or this company actually has zero knowledge of the product they're selling and shouldn't be trusted with your site's security

I love how suddenly the NSA is the only entity out there who has an interest in private keys.

I think it is pretty hard to argue that they are not one of the most aggressive entities doing this.

Re: This seem legit...

#10

Post by racbart » Thu, Oct 31, 2013, 12:40 PM UTC

This should be a feature on the NSA website.