4 ms·
I contacted their support: Me: I wanted to know more about your certificate key matcher isn't the private key always meant to remain... private? Emanuele: Yes
by jawr 13y ago
I contacted their support:
Me: I wanted to know more about your certificate key matcher
isn't the private key always meant to remain... private?
Emanuele: Yes, it should. We offer the tool to help verify the correspondence SSL certificate it is lost.
Me: But it would be sent over HTTP and viewable to anyone along the network.
Emanuele: The page can also be accessed through HTTPS.
Me: I think it should be enforced. Also something like this should be done client side. Perhaps using crypto.js
Emanuele: OK, I will pass your comment to our General manager.
- ctz 13y agoSo leaking my private key to somebody is OK if I do so over HTTPS, and even better if I encrypt it with a javascript crypto library beforehand? I don't think you've thought this through.
- redblacktree 13y agoI think he was suggesting that, instead of sending the private key to this web server, the check they're doing could be implemented client-side, thus avoiding the need for the key to transit the wire. I haven't been able to access the site though, so I may be way off in my understanding of what it does.
- jawr 13y agoSending it over HTTPS at least narrows down the recipient to.. who it's intended for. And I wasn't suggesting encrypting and then sending it to them, instead perform the check on the client side in a way that no information is ever sent back to their server; using the browser as a platform to run an "app". I don't condone this at all, but if they're adamant about providing this service they should at least try and make it less damning than it already is.