4 ms·

lovely interface, but the security is rendered completely pointless as the private key is generated remotely... you can't offer a secure version of this on a re

• lucb1e 14y ago
  You can. It's called Javascript and there are libraries to do public key encryption. But yes, here you are right, the cert is generated by the server in this case.
  • ygjb 14y ago
    Until DomCrypt[1] is implemented there is no reliable way to implement a CSPRNG in Javascript (that I am aware of!). The only way to do this securely would be to supply a page that includes some javascript to process a secret key that the user provides to the page which would then generate the CSR. It would be more effective to write all of this sites functionality into a shell script. [1] http://www.w3.org/TR/WebCryptoAPI/ http://www.w3.org/TR/WebCryptoAPI/
    • subleq 14y ago
      I did a CSPRNG in Javascript using mouse movements for entropy: https://github.com/fusionbox/mouseware https://github.com/fusionbox/mouseware
      • ygjb 14y ago
        I don't see a detailed analysis of your RNG that would support the claim that it is suitable for use as a CSPRNG.
  • blibble 14y ago
    so by doing that you're still trusting the server not to send you evil Javascript that surreptitiously posts off your private key. it's exactly equivalent from a security perspective, unless you read every line of Javascript, in which case you might as well read the openssl manual instead and generate the CSR yourself. (note that there's a rarely used <input> keygen type, but to sign the CSR you'd need programmatic access to the private key, again defeating any security properties).