Hacker News Reader

It's not that the key is generated in Javascript; it's more that the key is generated (and therefore known) by someone who is not you.

Maybe you trust StartSSL with your private key, maybe you don't, but in either case not giving them your private key is preferable.

View on HN

It's not... your local web browser generates it by the `<keygen>` element. The private key never leaves your web browser and is not known to StartSSL.

Just to note that Internet Explorer does this slightly differently, using VBScript to call the local crypto API as it doesn't support <keygen>. It's functionally equivalent though.

As stated in their CPS (with the exception of SMIME) and my post, it does not use <keygen>...

Reply on news.ycombinator.com