This seem legit... • Hacker News Board

namuol wrote: post #7

chmod775 wrote: post #2

To clarify: DO NOT DO THIS. 1. Never give your private key to anyone 2. Especially not if it is sent over an unencrypted connection (the site doesn't even use https) 3. Don't. Just don't. This is either the weakest attempt of the NSA to collect private SSL keys ever, or this company actually has zero knowledge of the product they're selling and shouldn't be trusted with your site's security

I love how suddenly the NSA is the only entity out there who has an interest in private keys.

at least we know that's it is the most interested, funded and staffed to do it.

Re: This seem legit...

#25

Post by fishbacon » Thu, Oct 31, 2013, 1:02 PM UTC

scottydelta wrote: post #20

haha, Its hilarious, reminded me of this http://d24w6bsrhbeh9d.cloudfront.net/photo/350850_700b_v1.jp...

This is of course an old joke from bash.[1]

[1]http://www.bash.org/?244321

Re: This seem legit...

#26

Post by icebraining » Thu, Oct 31, 2013, 1:03 PM UTC

Apparently the feature is widespread:

https://www.sslshopper.com/certificate-key-matcher.html

http://www.ssltools.com/cert_key_match

https://certificatesssl.com/ssl-tools/match-ssl-details.html

http://www.mobilefish.com/services/privatekey_match_certific...

http://sslchecker.com/matcher

Re: This seem legit...

#27

Post by icebraining » Thu, Oct 31, 2013, 1:05 PM UTC

a3_nm wrote: post #22

Related: http://www.inutile.ens.fr/estatis/password-security-checker/

I love the "Test another password?" prompt. I wonder how many people actually use it.

Re: This seem legit...

#28

Post by scottydelta » Thu, Oct 31, 2013, 1:09 PM UTC

fishbacon wrote: post #25

scottydelta wrote: post #20

haha, Its hilarious, reminded me of this http://d24w6bsrhbeh9d.cloudfront.net/photo/350850_700b_v1.jp...

This is of course an old joke from bash.[1] [1] http://www.bash.org/?244321

yes it is, actually this one is better ;)

Re: This seem legit...

#29

Post by ctz » Thu, Oct 31, 2013, 1:23 PM UTC

jawr wrote: post #13

I contacted their support: Me: I wanted to know more about your certificate key matcher isn't the private key always meant to remain... private? Emanuele: Yes, it should. We offer the tool to help verify the correspondence SSL certificate it is lost. Me: But it would be sent over HTTP and viewable to anyone along the network. Emanuele: The page can also be accessed through HTTPS. Me: I think it should be enforced. Al…

So leaking my private key to somebody is OK if I do so over HTTPS, and even better if I encrypt it with a javascript crypto library beforehand?

I don't think you've thought this through.

Re: This seem legit...

#30

Post by ceautery » Thu, Oct 31, 2013, 1:26 PM UTC

ddoolin wrote: post #15

chmod775 wrote: post #2

To clarify: DO NOT DO THIS. 1. Never give your private key to anyone 2. Especially not if it is sent over an unencrypted connection (the site doesn't even use https) 3. Don't. Just don't. This is either the weakest attempt of the NSA to collect private SSL keys ever, or this company actually has zero knowledge of the product they're selling and shouldn't be trusted with your site's security

Nobody else got the subtle sarcasm, but I did. No worries, man. But seriously, if it was the NSA, I like how quick everyone is to dismiss the notion!

There are thousands of us who see the subtle implications of comments, and roll our collective eyes at the knee-jerk, replies from people who missed it. The proclivity for this type of boring, predictable reply is the main reason I don't post very much. I tend to get the "you are either stupid or a jerk!!" replies myself.

(Rest assured, it's the latter, not the former.)