Unsure: Website provides private key

[fsteinel]

The Site https://easydmarc.com/tools/dkim-record-generator provides the private key for DKIM usage.
Unsure about the project to report this.

[BenBE]

This situation is fundamentally different from what this project aims to document. The purpose here is to catalogue private keys that were leaked, exposed, or compromised - whether through operational mistakes, misconfigurations, or cryptographic weaknesses.

A third‑party service that creates private keys on behalf of users is a different category of problem: it’s not a leak, but a design flaw that prevents the domain owner from ever having exclusive control of their signing key.

The most constructive path is to contact the operators of that site and encourage them to provide a fully offline key‑generation tool, or at minimum a client‑side implementation where the private key never leaves the user’s browser.

Because this isn’t a case of a key being leaked or compromised after creation, but rather a service that shouldn’t be generating private keys at all, it doesn’t fit the scope of this project.

NB: If you find a general algorithmic issue with the keys generated by that site, I think @hannob might want a note for his badkeys project though … ;-)

[fsteinel]

I feel overhelmed and understand the kompromat files is the wrong organisation.
Sorry to be not of any help.
Wishes to document this adleast somewhere.