Private key being corrupted by FlashGot

[carl.schutte]

Hi,

I downloaded a private key from Amazon Web Services (AWS) and after pulling my hair out for most of last night trying to figure out why I couldn't connect to my EC2 instance, I realised that my private key was corrupted.

When I initiate the download with FlashGot it corrupts the file, but if I download directly with DownThemAll (or Firefox) the key is fine.
It doesn't look like I can attach files to this post, so I'll just past the key contents here.

First is the correct key, followed by the corrupted key (I've truncated them a bit because they seem to be triggering the forum's spam filter. FlashGot appears to be replacing "+" characters with " " (blank space).
Any idea why this is happening?

-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAp4EgY5EIlAJ+YiVsmAs5HO+1TBQD9lkIBwmZSecOxgF3uRyhlgFEXZg4R3Ei
-----END RSA PRIVATE KEY-----

-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAp4EgY5EIlAJ YiVsmAs5HO 1TBQD9lkIBwmZSecOxgF3uRyhlgFEXZg4R3Ei
-----END RSA PRIVATE KEY-----

Thanks,
Carl

[Thrawn]

I'm glad you truncated the key, for reasons other than the spam filter. This is a public forum, and it wouldn't be a good idea to advertise your private key!

That said, I'm not sure why FlashGot is doing this. Is it definitely FlashGot causing the trouble? What other addons are you running?

[carl.schutte]

Well, I can't categorically state that it's not some other add-on which is interacting with FlashGot in some strange way.
As I said, if I use DTA or Firefox's native download to obtain the key, it is valid.

Other add-ons include:

• Adblock Plus 2.3.2
• DownThemAll! 2.0.16
• English (Australian) Dictionary 2.1.2
• Evernote Web Clipper 5.7
• LastPass 2.0.20
• Persona Plus 1.7.2.1
• Remember The Milk for Gmail 1.0.7
• Xmarks 4.2.3

[therube]

Nothing special with a key, is there?
Simply ASCII text?

Can't see how, why FlashGot would do anything at all to the stream?
After all, all it is doing is providing a link to your download manager?

privatekey.ppk


If you disable all other extensions except for FlashGot & DTA do you still get the corruption?


The only difference between the good & the bad are the substitution of " " for + ?

[Thrawn]

It sounds like the kind of thing an xss filter would do, but I can't see why that would happen to a downloaded file. And this is FlashGot, not Noscript.

[Giorgio Maone]

I'm not sure I fully understand the situation.
Is this key sent along with the request for the download, or part of the response (in other words, are you using it or trying to download it)?

[Thrawn]

After all, all it is doing is providing a link to your download manager?

privatekey.ppk

Erm...therube, you didn't need that private key for anything important, did you?

Want to delete/break that link? I've broken the copy in this post.

[therube]

No, I just downloaded a keygen to see what a key would look like.
It is of no importance or value.

[carl.schutte]

I'm not sure I fully understand the situation.
Is this key sent along with the request for the download, or part of the response (in other words, are you using it or trying to download it)?

The key is the file that I'm trying to download.
When you launch an EC2 instance with AWS you download a private key which you need to SSH into your newly created VM.

[carl.schutte]

Nothing special with a key, is there?
Simply ASCII text?

I'm viewing it in Notepad++ as ANSI as UTF-8.
I don't see any weird characters... all things that appear on the keyboard [a-z0-9-+/= ]

Can't see how, why FlashGot would do anything at all to the stream?
After all, all it is doing is providing a link to your download manager?

If you disable all other extensions except for FlashGot & DTA do you still get the corruption?

The only difference between the good & the bad are the substitution of " " for + ?

I disabled all other add-ons and the problem still persists.
Interestingly though, your supplied download works fine... no corruption.
Yes, it's consistently the substitution of " " for "+"