Worst Idea Ever: SSHKeygen.com

by bkrausz • 18 years ago

79 32 18 years ago

jamess• 18 years ago

Oh dear god. I can only hope this is an attempt to crack idiots servers, rather than a serious service. I love the "it's your responsibility to secure your key in transit" disclaimer.

dfranke2• 18 years ago

The "it's got what admins crave" line makes me pretty sure it's intended to be silly.

apathy• 18 years ago

electrolytes, mostly

rit• 18 years ago

Coupled with the fact that the page is HTTP and the server doesn't seem to support HTTPS!

Hexstream• 18 years ago

I think it's actually a pretty good idea.

If your goal is to scam clueless people, of course.

coglethorpe• 18 years ago

New YCombinator startup idea!

Passwords are hard to remember. I can create a service to store their userIds, passwords and sites. That way people have to only go one place to get them. I'll call it a "personal ID agregator" during my VC pitches.

I could make all the data public and accessible from anywhere using a simple API.

Users could vote on which passwords are the strongest. The wisdom of crowds would lead us to the better security!

Man I need a cup of coffee to get going on this. No, wait, I've had 6 cups already...

ppdes• 18 years ago

easy implementation too. just redirect to bugmenot

rms3• 18 years ago

It's been done. http://en.wikipedia.org/wiki/Claria_Corporation

jmorin007• 18 years ago

I just generated mine at Starbucks!

Is that bad?

pierrefar• 18 years ago

As long as you didn't spill coffee and damage your keys in transit, it's fine :)

nose• 18 years ago

http://cryptofile.com/yep.php

dfranke2• 18 years ago

I wonder if the server runs Debian.

livejamie• 18 years ago

Domaintools shows they have 'private registration' and a established SSL cert even though they're not using one and on the site claim they're 'getting one soon'

http://whois.domaintools.com/sshkeygen.com

Pretty fishy.. or should I say.. phishy?

rw• 18 years ago

How did you find this site?

Allocator2008• 18 years ago

This is funny. Reminds me of the chap who wondered on an online forum about how to hack his school's server, and forthwith acted upon the advice from the forum to send a "ping of death" to the i.p. address "127.0.0.1"! :-) Could just be an urban legend, but still amusing!

johns• 18 years ago

http://www.bash.org/?742386

mst• 18 years ago

Oh, it's common enough, though it's usually easier to get them with something like 127.4.132.17.

Well, or warez.<domain> - there's a long tradition of A-ing that to 127.0.0.1, I use warez.trout.me.uk as a cloak on IRC and there've been a couple times idiots have tried to flood me off the net with predictable results ...

MikeCapone• 18 years ago

That's hilarious!

dangoldin• 18 years ago

Man. Where's the credit card field? I want to pay for such a sweet service.

narag• 18 years ago

Don't worry. You will. Sooner or later :-)

megabang• 18 years ago

May be we should do something about it!?

pjackson• 18 years ago

Guh. It doesn't even send your private key back to you using SSL. Not that it would matter much. I don't want my keys escrowed!

chmike• 18 years ago

It is secured by the pass phrase! :D

ahizzle• 18 years ago

The "best practice" bit is priceless.

maskralc• 18 years ago

Come on - if you are smart enough to know how to use ssh keys then you are too technically smart to fall for this. Grandma is not going to have her server hacked because she tried this. It's gotta be a joke.

rms3• 18 years ago

This is a really funny parody of the idea that all you need for a Web 2.0 startup is a cloned Unix command.

HansF• 18 years ago

Heh "It is your responsibility to secure your new key pair in transit." it's not even https. Funny!

Erwin• 18 years ago

On To Do page: buy a SSL certificate or self-sign so key transfer is not in the clear

Haha. I don't think the idea (if this is not a scam/joke) has merit because even if you forget your SSH passphrase, you have access to the server via a root password (stored somewhere safely in a fireproof-safe; and even if not physical access at worst). So the traditional key escrow should not be necessary.

ivank2• 18 years ago

reverse DNS points to 208.185.168.22.zipmath.com

Also hosted on the same IP: http://cracks.n.hax.com/ and http://portcode.com/

bayes• 18 years ago

This is probably a stupid question, but how did you find out what other sites were hosted at that IP address? Are you reliant on search engine data, or is there some other way of doing it?

ivank2• 18 years ago

I used http://www.paterva.com/maltego/ to do it. I have no idea where the data comes from.

rms3• 18 years ago

That makes sense, so this is a random project/joke/hack from a security consultant (funny how hacker is the wrong word).

Worst Idea Ever: SSHKeygen.com

Related Stories