MBBSoftware Our Public Authentication Key (?) Our Public Encryption Key (?)
  Products Downloads Learning Support Store Blog About  Welcome Guest  |Login| My Account  
Make Website Trusted With Testimonial Protocol - Best Practices
Learning Home Safe Online Communication Make Your Website Trusted How to Store Private Keys  
Overview Introduction Authentication Protocol Example of Implementation Best Practices  
 
Best Practices - Website Testimonials
Best Practices For Website Visitors When Authenticating a Testimonial
  1. Use automatic test since it is simpler, faster and error resistant. However, verify that the automatically-supplied URLs are as they should be.
  2. If necessary, use the clipboard to copy the URL of the embedded testimonial file, the signature and the Public Key, and supply them to the authenticate-testimonial website.
  3. If necessary, use the browser to review the testimonial page source.
  4. If necessary, download the testimonial, its signature and the public key, and use Act On File to manually authenticate it.
Best Practices When Making a Testimonial
  1. Once a Public Key is published on a website, it must always be available there for as long as there are authenticatable documents to be used by third parties which are signed by the private key counterpart.
  2. A published Public Key should retain its original name and URL at all times, e.g. http://www.website.com/keys/www.website.com.key1.public-key-auth-verify. Thus, if in the future a new key pair replaces the first one, its public key can be named http://www.website.com/keys/website.com.key2.public-key-auth-verify, etc. In this case all public keys should be also displayed at a specialized administrative page together with the dates on which they were in use. The current Public Key can be also available from a more prominent position so that the visitors have easier access to it. Public Keys should not change their URL as other websites may link to them when implementing automatic testimonial authentication, or quote their URLs for manual authentication. Note: It is good practice to prepend the domain name to the name of the public key as shown in the example. Use "-" to replace "." if your web server requires.
  3. In the testimonial, display the date when the testimony was created and signed. This is not only helpful for the testimonial itself, but also may be useful to help locate the correct Public Key if the testifying (your) website changes its key pair, and/or possibly changes the name of the published Public Key.
  4. In the testimonial, display the name of the testimony-giving (your) website, or better, the URL of the Public Key on the testifying website. This makes the testimonial user-friendly and trustworthy. Using a versioned name of the Public Key would greatly assist any disambiguation that may be required in the future if these best practices are not followed.
  5. In the testimonial, display the hash code of the Public Key. This makes the testimonial user-friendly and trustworthy. The user can visually verify that they are using the correct or incorrect public key. Use the SHA1 hash of the Public Key in standard byte order, expressed as a string of hexadecimal values, e.g. 446CE282BE959832BC36866F8E219F0FD15AD489. You can use the Hash Files functionality of the Authenticator module of Act On File to produce the hash.
  6. Use the default settings of Act On File to produce the signature. This would minimize the possibility of errors caused by an incorrect choice of settings.
  7. In the testimonial, display the settings of Act On File used to produce the signature. Even if using the default settings, record this, or the particular settings being used.
  8. Never replace an old public key with a new one bearing the same name/URL. If a public key is lost, then it is better to not have it at all rather than to replace it since all authentications of testimonials and files signed with the old key pair will fail.
Best Practices When Publishing a Testimonial - FOR WEB DEVELOPERS
  1. Keep a copy of the Public Key of the testifying website. If they lose their Public Key for some reason, you can give it to them to (re)-publish it on their website. Alternatively they need to create a new signature for the testimonial using their new Public-Private Key pair.
  2. Publishing testimonials ready for both automatic and manual authentication.
    • Manual Authentication (use an approach similar to our Example of Implementation).
      • Write an explanation for the visitors. This can be something similar the explanation we provide in our Example of Implementation.
      • Place links to the testimonial giver's website (more valuable link), and to their public key (easier to use link).
      • Make the download links of the testimonial, signature and Public Key as full, readable URLs so that the user can copy the URL and use manual or semi-automatic authentication if they wish.
    • Automatic Authentication - use the http://www.AuthenticateTestimonial.com website to provide Automatic Authentication links and allow the user to make a two click testimonial authentication. http://www.AuthenticateTestimonial.com recognizes the following query string parameters through which the automatic authentication link could supply the URLs of the testimonial file, its signature, the public key on the testifying website, and the appropriate settings for the authentication process. There are also a few additional parameters aiming to minimize the possibility for accidental error by the visitor, such as disabling fields which are filled or adjusted via the query string parameters. All parameters are optional.
      testimonial The URL of the testimonial file on the testified website.
      lock_testimonial True - locks the testimonial file text field, thus preventing the tester from changing the URL supplied via the "testimonial" parameter. False or omitted - the testimonial file text field is enabled and can be modified. This field is only valid if the "testimonial" parameter is also used. A change in the testimonial source combo-box unlocks the field.
      testimonial_sha1hash The SHA1 hash of the testimonial file in standard byte order, expressed as a string of hexadecimal values, e.g. 446CE282BE959832BC36866F8E219F0FD15AD489. This parameter is used to confirm that the appropriate file is being supplied, e.g. that the tester selected the correct file. To generate the ASCII hexadecimal representation you can use the Hash Files functionality of the Authenticator module of Act On File or the http://www.AuthenticateTestimonial.com service. For the latter simply supply the URL/file and click the Authenticate Testimonial button. The computed hash will be displayed under the file.
      signature The URL of the signature of the testimonial file on the testified website.
      lock_signature Same as lock_testimonial but for the signature text field.
      testimonial_sha1hash The SHA1 hash of the signature. Otherwise the same as testimonial_sha1hash.
      publickey The URL of the Public Key on the testifying website.
      lock_publickey Same as lock_testimonial but for the Public Key text field.
      publickey_sha1hash The SHA1 hash of the Public Key. Some important best practices for this field are described at Best Practices When Making a Testimonial.
      hash Set the required hash algorithm.
      flags Set the required flags.
      byteorder Set the required byte order.
      lock_settings True - disable the settings controls - available only if all settings are adjusted with the request. False or omitted leaves the setting controls enabled. The tester can enable locked settings controls by clicking the "Set Default Settings" button.
      authentication_error_notify Set the path on the testified host which will be called if authentication of a testimonial fails or another error occurs due to invalid data being supplied with parameter. Use this service to be notified when an automatic authentication link get broken and no longer works. The service will generate a POST request to the designated path on the testified server. A "testimonial" variable will hold the testimonial and an "error" variable will supply the exact error which has occurred. For example if the "authentication_error_notify=/testimonials/failed.aspx" then the authentication failure notification call will be a POST request to http://[host of the testimonial file]/testimonials/failed.aspx with parameters "testimonial" and "error". Note that to prevent abuse of this functionality it requires that the referrer (testified) host of the request is the same as the host of the testimonial file.


      An example for the code behind an automatic authentication link might look like this (formatted for readability):
      <a href="http://www.AuthenticateTestimonial.com/? testimonial=http%3a%2f%2fwww.mbbsoftware.com%2fLearning%2fExample-Testimonials%2fTestimonial-1.png &lock_testimonial=true &testimonial_sha1hash=894291ED84F6CDEC66443EDAE93397C5F7393903 &signature=http%3a%2f%2fwww.mbbsoftware.com%2fLearning%2fExample-Testimonials%2fTestimonial-1.png.signature &lock_signature=true &signature_sha1hash=8C3FBFBA969EFD9685FF6A6F699657A39F5D7941 &publickey=http%3a%2f%2fwww.miroslavbonchev.com%2f__public-keys%2fmiroslavbonchev-com-key1.public-key-auth-verify &lock_publickey=true &publickey_sha1hash=D5E791CF4D48B9007FA64066114E7A32DEA87DA6 &hash=SHA &flags=PKCS1 &byteorder=BigEndian &lock_settings=true &authentication_error_notify=%2fLearning%2fMake-Website-Trusted-Testimonial-Protocol%2fauthentication-error-notify.aspx" target="_blank">Authenticate Testimonial</a>


      The code below was used to produce the above automatic authentication link:
      <a href='<%= string.Format( @"http://www.AuthenticateTestimonial.com/? testimonial={0}&lock_testimonial=true&testimonial_sha1hash={1} &signature={2}&lock_signature=true&signature_sha1hash={3} &publickey={4}&lock_publickey=true&publickey_sha1hash={5} &hash=SHA&flags=PKCS1&byteorder=BigEndian&lock_settings=true &authentication_error_notify={6}", HttpUtility.UrlEncode( "https://mbbsoftware.com/Learning/Example-Testimonials/Testimonial-2.html" ), HttpUtility.UrlEncode( Bin2String( System.Security.Cryptography.SHA1.Create().ComputeHash( System.IO.File.ReadAllBytes( Request.PhysicalApplicationPath + "Learning\\Example-Testimonials\\Testimonial-2.html" ) ) ) ), HttpUtility.UrlEncode( "https://mbbsoftware.com/Learning/Example-Testimonials/Testimonial-2.html.signature" ), HttpUtility.UrlEncode( Bin2String( System.Security.Cryptography.SHA1.Create().ComputeHash( System.IO.File.ReadAllBytes( Request.PhysicalApplicationPath + "Learning\\Example-Testimonials\\Testimonial-2.html.signature" ) ) ) ), HttpUtility.UrlEncode( "http://www.miroslavbonchev.com/__public-keys/miroslavbonchev-com-key1.public-key-auth-verify" ), "D5E791CF4D48B9007FA64066114E7A32DEA87DA6", HttpUtility.UrlEncode( "/Learning/Make-Website-Trusted-Testimonial-Protocol/authentication-error-notify.aspx" ) ) %>' target="_blank">Authenticate Testimonial</a>

      Remarks on the example code:

      a. The hashes of the files are SHA 1, which can be produced using the Hash Files functionality of the Authenticator module of Act On File or dynamically when the page is loaded as in the case shown above. However the hash of the Public Key must always be placed as a constant, as shown above, in order that if the Public Key on the testifying website changes, then there will be an "Invalid/Unexpected" Public Key message as opposed to "NOT GENUINE" testimonial message.

      b. The non .NET API Bin2String function used in the example has the following content:
      public static string Bin2String( byte[] b1Blob ) { char[] caResult = new char[2*b1Blob.Length]; for( int Index = 0; Index < b1Blob.Length; Index++ ) { byte b1Byte = b1Blob[Index]; char b1MSHB = (char)( b1Byte >> 0x04 ); char b1LSHB = (char)( b1Byte & 0x0F ); caResult[2 * Index] = (char)( 0x30 + ( b1MSHB < 0x0A ? b1MSHB : b1MSHB + 0x07 ) ); caResult[2 * Index + 1] = (char)( 0x30 + ( b1LSHB < 0x0A ? b1LSHB : b1LSHB + 0x07 ) ); } return( new string( caResult ) ); }


      The code below is a PHP example: <?php echo '<a href="', sprintf( "http://www.authenticatetestimonial.com/? testimonial=%s&lock_testimonial=true&testimonial_sha1hash=%s&signature=%s&lock_signature=true&signature_sha1hash=%s &publickey=%s&lock_publickey=true&publickey_sha1hash=%s &hash=SHA&flags=PKCS1&byteorder=BigEndian&lock_settings=true&authentication_error_notify=%s", urlencode( "http://www.act-on-file-bg.com/Certificate-of-Representation.png" ), urlencode( sha1( file_get_contents( "Certificate-of-Representation.png" ), false ) ), urlencode( "http://www.act-on-file-bg.com/Certificate-of-Representation.png.signature" ), urlencode( sha1( file_get_contents( "Certificate-of-Representation.png.signature" ), false ) ), urlencode( "https://mbbsoftware.com/__public-keys/mbbsoftware.com.key1.public-key-auth-verify" ), "EBFAE4DB5BBA9426F483E4945776446AF2B0B2B8", urlencode( "authentication-error-notify.php" ) ), '" target="_blank">Authenticate Testimonial</a>'; ?>
  3. Make sure that there is a good explanation of how to authenticate testimonials for the visitors who are not yet acquainted with the methodology.
  4. Always verify that newly published testimonials are authenticating properly.
  5. Periodically verify that all published testimonials are authenticating properly.
Code of Conduct
  • Observe and follow the best practices as described above.
  • Be truthful when giving a testimonial. When enough data is available, public keys for untruthful testimonial givers may be blacklisted thus invalidating all of their testimonials.
  • When publishing a testimonial be kind and return a "follow" link to the testimonial-giver. They are putting their reputation on the line for you.
Go Back to Learning
Community Content
(To enter your comments you must be signed in. Log in or create FREE account.)
MemberComments
Be the first to comment.
 
   
© Copyright 2012 MBBSoftware Limited. All Rights Reserved. Disclaimer Privacy Antispam Email this page


Get Account
Get Newsletter
X
Email this page
To:
use semicolon to separate emails eg: [email protected]; [email protected]
Subject:
Message:
a link to this page will be automatically added to your message
From:
Please type the anti-bot text below.
Type text:  

Thank you for subscribing to the MBBSoftware newsletter.
Please enter your email address:
Please type the anti-bot text below.
Type text: