This seem legit...

http://www.trustico.ch/ssltools/match/cert-and-key-pem/check-if-certificate-and-key-match.php

by darkbot • 13 years ago

107 57 13 years ago

trustico.ch

chmod775• 13 years ago

To clarify: DO NOT DO THIS.

1. Never give your private key to anyone

2. Especially not if it is sent over an unencrypted connection (the site doesn't even use https)

3. Don't. Just don't.

This is either the weakest attempt of the NSA to collect private SSL keys ever, or this company actually has zero knowledge of the product they're selling and shouldn't be trusted with your site's security

namuol• 13 years ago

I love how suddenly the NSA is the only entity out there who has an interest in private keys.

blueblob• 13 years ago

I think it is pretty hard to argue that they are not one of the most aggressive entities doing this.

nraynaud• 13 years ago

at least we know that's it is the most interested, funded and staffed to do it.

makmanalp• 13 years ago

Never attribute to malice that which is adequately explained by stupidity.

This just seems like some newbie programmer was like "hey, wouldn't it be cool if"... and built themselves a weekend project that they released on the site.

Obviously it's terrible for a site that sells SSL stuff, but concluding that this is the NSA is pretty hugely premature.

edit: Duh, didn't pick up on the sarcasm. In my defense, the parent text was way more vague at the time. :)

floobynewb• 13 years ago

To be fair, I'm pretty sure he had his tongue firmly in his cheek. But point well made. Whenever this point comes up I think of a scene from 'the cube', is it a massive conspiracy or utter incompetence combined with some kind emergent process?

ddoolin• 13 years ago

Nobody else got the subtle sarcasm, but I did. No worries, man. But seriously, if it was the NSA, I like how quick everyone is to dismiss the notion!

ceautery• 13 years ago

There are thousands of us who see the subtle implications of comments, and roll our collective eyes at the knee-jerk, replies from people who missed it. The proclivity for this type of boring, predictable reply is the main reason I don't post very much. I tend to get the "you are either stupid or a jerk!!" replies myself.

(Rest assured, it's the latter, not the former.)

codfrantic• 13 years ago

I was hoping it was at least javascript...

tankenmate• 13 years ago

Woah, I couldn't ever envisage ever trusting a "security company" that not only encouraged you to disclose your private key, but also provided a form for doing it over a non encrypted connection!

My personal opinion is don't use these guys; this is either a school boy error/complete incompetence or totally dubious.

jawr3• 13 years ago

Brilliant.

mgbmtl2• 13 years ago

Wow, at first I seriously thought this site was a fake copy of the official Trustico site (they have trustico.ca, trustico.com, etc)... but the form exists on all their sites:

http://www.trustico.ca/ssltools/match/cert-and-key-pem/check...

elithrar• 13 years ago

I had these guys @reply me on Twitter when I tweeted about how it's easier to figure out what cipher suite to use compared to figuring out what SSL product I need.

They were helpful but thank god I didn't buy a cert from them: this page is a terrible, terrible idea that erodes their trust completely.

racbart• 13 years ago

This should be a feature on the NSA website.

fosap• 13 years ago

But has a verysign logo. It has be trustworthy.

jawr3• 13 years ago

I contacted their support:

Me: I wanted to know more about your certificate key matcher isn't the private key always meant to remain... private?

Emanuele: Yes, it should. We offer the tool to help verify the correspondence SSL certificate it is lost.

Me: But it would be sent over HTTP and viewable to anyone along the network.

Emanuele: The page can also be accessed through HTTPS.

Me: I think it should be enforced. Also something like this should be done client side. Perhaps using crypto.js

Emanuele: OK, I will pass your comment to our General manager.

ctz2• 13 years ago

So leaking my private key to somebody is OK if I do so over HTTPS, and even better if I encrypt it with a javascript crypto library beforehand?

I don't think you've thought this through.

redblacktree• 13 years ago

I think he was suggesting that, instead of sending the private key to this web server, the check they're doing could be implemented client-side, thus avoiding the need for the key to transit the wire.

I haven't been able to access the site though, so I may be way off in my understanding of what it does.

jawr3• 13 years ago

Sending it over HTTPS at least narrows down the recipient to.. who it's intended for. And I wasn't suggesting encrypting and then sending it to them, instead perform the check on the client side in a way that no information is ever sent back to their server; using the browser as a platform to run an "app".

I don't condone this at all, but if they're adamant about providing this service they should at least try and make it less damning than it already is.

ge0rg2• 13 years ago

I just tested the form with a key+cert pair I created for this sole purpose. It actually performs as advertised - it checks if key and cert belong together.

robzyb• 13 years ago

You have not provided any proof that it actually performs as advertised.

Maybe it just says that for any and all inputs??

ge0rg2• 13 years ago

To clarify the issue: I performed the following steps:

1. created a CA key+cert (selfsigned) 2. created a keypair K 3. signed the public key of K with the CA 4. uploaded the CA-signed cert and the private key of K --> "Your Certificate and Key match" 5. uploaded the CA cert (not the one of K) and the private key of K --> "Certificate an Key do NOT match."

terhechte2• 13 years ago

BITCOIN ADDRESS MATCHER

Want to make sure that your bitcoin address works? Just send money to

1JqjU7zBvbhyrDFjtJG6xAwMm5BUVmtpau

and if you don't receive an error, you can rest assured that your bitcoin address works!

chrisbridgett• 13 years ago

https://blockchain.info/address/1JqjU7zBvbhyrDFjtJG6xAwMm5BU...

Watching with interest... xD

terhechte2• 13 years ago

Empty as expected :) Edit: Nevermind, somebody send a cent. Your address works! ;)

ye• 13 years ago

I'd rather use this

1PtQmxewNJWYeDUieM2cLqU9XcAoBEfWaQ

You send the money there, it sends you back the double amount.

pepijndevos• 13 years ago

Doesn't work for me. Maybe I need to send a bigger amount for it to trigger?

scottydelta2• 13 years ago

haha, Its hilarious, reminded me of this http://d24w6bsrhbeh9d.cloudfront.net/photo/350850_700b_v1.jp...

fishbacon• 13 years ago

This is of course an old joke from bash.[1]

[1]http://www.bash.org/?244321

scottydelta2• 13 years ago

yes it is, actually this one is better ;)

utopcell• 13 years ago

too awesome! :)

a3_nm• 13 years ago

icebraining2• 13 years ago

I love the "Test another password?" prompt. I wonder how many people actually use it.

NotOscarWilde• 13 years ago

c. You agree to pay $ 100,000 for your use of the Estatis Free Password Security Checker if we ever ask for it.

chengsun• 13 years ago

If you repeatedly test another password, the prompt changes. Quite hilarious.

Also, the terms and conditions are fake too.

"If you read all the legalese up to this point (or just got there by random scrolling), you probably have noticed that this document is complete nonsense. [...] First, chapter 10 of Mary Shelley's /Frankenstein/. Second, a copy of some treaty."

swoker• 13 years ago

Anyone else who tested it with "correct horse battery staple"? :D

kirab2• 13 years ago

404 submissions (password not found)

Damn, this is becoming addictive.

kirab2• 13 years ago

10000 submissions (woaw, a day's work just passed)

- I cheated, I admit.

danso• 13 years ago

At the very least, I hope a successful submission is rewarded by a redirect to: http://www.youtube.com/watch?v=awK0NrgHUbk

icebraining2• 13 years ago

Apparently the feature is widespread:

https://www.sslshopper.com/certificate-key-matcher.html

http://www.ssltools.com/cert_key_match

https://certificatesssl.com/ssl-tools/match-ssl-details.html

http://www.mobilefish.com/services/privatekey_match_certific...

http://sslchecker.com/matcher

mgbmtl2• 13 years ago

Scary. To be fair, although this kind of tool should not exist at all, the sslshopper tool at least has a warning, enforces https and informs users how to check it properly on the command line. The others, however, do not.

ctz2• 13 years ago

It would be really cool if they parsed the issuer from the certificate you provided, and informed your CA that your private key was just compromised if the key matched.

cornet2• 13 years ago

So I tweeted them earlier and just got this response:

"Hello, the tool will be removed from all our websites within the next 30 minutes. Thanks."

https://twitter.com/MrTrustico/status/395905251313586176

cornet2• 13 years ago

Update: and it's gone

theseoafs• 13 years ago

What was it?

trustico2• 13 years ago

Hello,

that tool will be removed from all our websites within the next 30 minutes.

Trustico Online Limited

jcromartie• 13 years ago

Congratulations. Your customer base today = (customer base yesterday) - (hacker news readership).

Kiro• 13 years ago

What was it?

trustico2• 13 years ago

Hi,

The tool was made available for customers to legitimately check if the Private Key matched the SSL Certificate that was being installed - a common question and feature request from our customers.

However, upon review of the comments made in the internet community we have made a decision to remove this specific tool and to review all other tools that we make publicly available via our websites.

We also saw a heavy attempt to hack/abuse this tool over the past few hours, perhaps to look for exploits, an action I find absurd for those who make out to be security conscious.

I welcome any further comments on how we can improve our service and do hope that our actions to remove the tool today were prompt and satisfactory.

Zane Lucas General Manager Trustico Online Limited

jackmaney• 13 years ago

Look, I have absolutely no background in security, but I could tell immediately that this was an absolutely horrible idea.

What were you thinking? That's not a loaded question. I literally have no idea what was going through the mind of anyone at your company when it was decided to build this abomination.

angersock• 13 years ago

Thank you for your prompt response.

pliny• 13 years ago

Since you are a site that sells SSL certificates, it would be appropriate for you to enforce HTTPS when communicating with your website.

hellerbarde2• 13 years ago

And it's been taken down. This is still up though and just as bad:

http://www.trustico.ch/ssltools/convert/pem-key-to-der/conve...

dspillett• 13 years ago

"The page you have tried to access is not responding properly and we can't display it at the moment." - looks like they are embarrassed enough to take it down. Anyone have the original text for me to snigger at? Way-back machine and Google don't seem to have it cached.

This seem legit...

Related Stories