Looks like Google Ads and Google Analyics are both running on the page with your private key and public key. So every key pair generated is probably stored by both of those services--forever.
Csr.io - a better certificate signing request generator
21–30 of 30 posts
Re: Csr.io - a better certificate signing request generator
#22lovely interface, but the security is rendered completely pointless as the private key is generated remotely... you can't offer a secure version of this on a remote website.
You can. It's called Javascript and there are libraries to do public key encryption. But yes, here you are right, the cert is generated by the server in this case.
Until DomCrypt[1] is implemented there is no reliable way to implement a CSPRNG in Javascript (that I am aware of!). The only way to do this securely would be to supply a page that includes some javascript to process a secret key that the user provides to the page which would then generate the CSR. It would be more effective to write all of this sites functionality into a shell script.
Re: Csr.io - a better certificate signing request generator
#23Wow, hats off to whoever came up with this incredibly useful and perfectly safe tool. :) (I wonder how many private keys they'll end up with. This is a cheaper if somewhat less universal attack than compromising a CA directly.)
Well from what I've looked at, it seems that at least four entities will receive copies of every key pair. One to csr.io, one to Google Adsesne, one to Google Analytics, and one for the user.
Re: Csr.io - a better certificate signing request generator
#24Open source?
It's probably using openssl on the back end which is open source. http://www.openssl.org/
Re: Csr.io - a better certificate signing request generator
#25Earlier quoted context omitted.
You can. It's called Javascript and there are libraries to do public key encryption. But yes, here you are right, the cert is generated by the server in this case.
Until DomCrypt[1] is implemented there is no reliable way to implement a CSPRNG in Javascript (that I am aware of!). The only way to do this securely would be to supply a page that includes some javascript to process a secret key that the user provides to the page which would then generate the CSR. It would be more effective to write all of this sites functionality into a shell script. [1] http://www.w3.org/TR/WebCry…
I did a CSPRNG in Javascript using mouse movements for entropy: https://github.com/fusionbox/mouseware
Re: Csr.io - a better certificate signing request generator
#26lovely interface, but the security is rendered completely pointless as the private key is generated remotely... you can't offer a secure version of this on a remote website.
You can. It's called Javascript and there are libraries to do public key encryption. But yes, here you are right, the cert is generated by the server in this case.
so by doing that you're still trusting the server not to send you evil Javascript that surreptitiously posts off your private key.
it's exactly equivalent from a security perspective, unless you read every line of Javascript, in which case you might as well read the openssl manual instead and generate the CSR yourself.
(note that there's a rarely used keygen type, but to sign the CSR you'd need programmatic access to the private key, again defeating any security properties).
Re: Csr.io - a better certificate signing request generator
#27Re: Csr.io - a better certificate signing request generator
#28Earlier quoted context omitted.
Until DomCrypt[1] is implemented there is no reliable way to implement a CSPRNG in Javascript (that I am aware of!). The only way to do this securely would be to supply a page that includes some javascript to process a secret key that the user provides to the page which would then generate the CSR. It would be more effective to write all of this sites functionality into a shell script. [1] http://www.w3.org/TR/WebCry…
I did a CSPRNG in Javascript using mouse movements for entropy: https://github.com/fusionbox/mouseware
I don't see a detailed analysis of your RNG that would support the claim that it is suitable for use as a CSPRNG.
Re: Csr.io - a better certificate signing request generator
#29Re: Csr.io - a better certificate signing request generator
#30Many HNers are understandably bashing this for privacy concerns. However, csr.io addresses a real problem, that generating CSR's is a pain in the neck.
Let me be the first to offer a positive suggestion: csr.io should keep doing exactly the same thing, but on the "results" page where it shows the key and CSR now, also generate and show the equivalent OpenSSL commands for someone to generate a key on their own machine. These commands should be able to be blindly copy/pasted into any Mac/Linux command prompt where OpenSSL is installed.